Listen to this Post
CVE-2026-21858 is a critical unauthenticated vulnerability in the n8n workflow automation platform.
The issue originates from improper handling of HTTP content types during file upload parsing.
Applications rely on Formidable middleware to process multipart form-data requests safely.
When an attacker alters the Content-Type header to application/json, routing breaks down.
The server invokes the standard JSON body parser instead of the file handler.
This content-type confusion bypasses normal input validation and safety checks entirely.
Attackers gain the ability to override internal request variables during execution.
Specifically, the filepath parameter used in file copying operations becomes fully controllable.
Downstream workflow nodes process attacker-supplied file paths instead of user uploads.
The application reads sensitive local system files and leaks their contents.
Adversaries exploit this arbitrary file read to target internal application databases.
Extracting valid session identifiers from disk enables seamless authentication bypass.
An unauthenticated remote attacker escalates privileges to system administrator status.
Administrative dashboard access allows creating malicious workflows with execution nodes.
Attackers can execute arbitrary operating system commands on the host server.
The vulnerability transforms a local file read into complete remote code execution.
Compromised n8n instances expose integrated cloud credentials, API tokens, and databases.
All self-hosted deployments running versions prior to 1.121.0 are vulnerable to attack.
Security researchers from Cyera Labs publicly disclosed this critical flaw.
Immediate upgrading to version 1.121.0 or later is mandatory for remediation.
Network segmentation prevents external exposure of vulnerable internal service ports.
Monitoring incoming HTTP headers helps detect content-type manipulation attempts.
Auditing workflow modifications prevents unauthorized creation of file-reading nodes.
Failing to patch leaves core enterprise automation infrastructure completely exposed.
Threat actors actively scan for unexposed instances to hijack internal credentials.
Robust defensive postures require strict least-privilege role assignments for users.
Reviewing recent workflow logs ensures no anomalous file activity occurred.
Patch management remains the single most effective defense against this exploit.
Deploying WAF signatures blocks malicious payload structures targeting this flaw.
The severity rating of this CVE sits at the maximum CVSS score.
DailyCVE Form:
Platform: n8n workflow platform
Version: Before 1.121.0
Vulnerability: Arbitrary file read
Severity: Critical risk level
date: January 7 2026
Prediction: Released January 2026
What Undercode Say:
curl -X POST "http://target:5678/webhook/chat" \
-H "Content-Type: application/json" \
-d '{"files": {"filepath": "/etc/passwd"}}'
Exploit: (Educational Purposes!)
The exploit involves sending a crafted HTTP POST request with an altered Content-Type header to trigger parser confusion. By overriding internal request object variables, the attacker forces the file-handling node to read local system files instead of user uploads. The retrieved file contents are returned through the workflow response or chat interface, exposing sensitive session tokens or administrative credentials used for subsequent session hijacking and command execution.
Protection: from this CVE
Upgrade the n8n instance to version 1.121.0 or later immediately. Ensure that network ingress filters block direct external access to internal webhook endpoints unless properly authenticated. Implement strict monitoring of HTTP header anomalies and review workflow configurations for unauthorized file-handling nodes.
Impact:
Successful exploitation grants unauthenticated remote attackers full administrative control over the n8n instance. Because n8n often centralizes credentials for cloud storage, payment processors, and enterprise databases, attackers gain sweeping access to connected organizational infrastructure and sensitive data assets.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
