CVE-2026-21858
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
Description
n8n is an open source workflow automation platform. Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow could grant access to an unauthenticated remote attacker, resulting in exposure of sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage. This issue is fixed in version 1.121.0.
CVSS Vector Breakdown
AV:NAttack VectorAC:LAttack ComplexityPR:NPrivileges RequiredUI:NUser InteractionS:CScopeC:HConfidentialityI:HIntegrityA:NAvailabilityWeaknesses
Affected Products
Exploitability
Exploit details including PoC links, Metasploit modules, and scanner templates are available after registration.
View exploit detailsAttack Graph
Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.
MITRE ATT&CK
1 techniqueReferences
- Chinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable serversen-us·Help Net Security·
- Hacker uses DeepSeek AI to autonomously attack vulnerable serversen-us·BleepingComputer· Exploited Langflow knaithe
- Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacksen·The Hacker News· Exploited Langflow knaithe
- ThreatsDay: AI-Powered Hacking, 370 Chrome Flaws, SonicWall Attacks, DNS Hijacking + 22 More Storiesen·The Hacker News· Roundup xplogs22 phishing
- Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacksen-us·Palo Alto Unit 42· PoC Hermes Agent knaithe
Unlock Complete Vulnerability Intelligence
Get the full picture for CVE-2026-21858 and every CVE in our database. Create a free account — no credit card required.
Create Free Account