Security1 hOctober 17, 2026, 15:29

Ni8mare in n8n: CVSS 10.0 flaw lets one webhook request take over a server

CVE-2026-21858, a maximum-severity CVSS 10.0 vulnerability in n8n, lets an unauthenticated attacker read any file on the server via a single crafted webhook request and fully compromise the host. Shadowserver found nearly 60,000 internet-connected instances still running vulnerable versions; the fix shipped in n8n 1.121.0.

DEV Community

Open source

Ni8mare in n8n: CVSS 10.0 flaw lets one webhook request take over a server

CVSS 10.0: exploit needs no authentication or workflow access
Nearly 60,000 exposed n8n instances still vulnerable, per Shadowserver
Reading .env and the database yields N8N_ENCRYPTION_KEY and all credentials
Patched in n8n 1.121.0; no official workarounds exist

#N8n

Dockhand CVE-2026-53988: CVSS 10.0 unauthenticated webhook auth bypass

Security

SonicWall SMA 1000 flaw rated CVSS 10.0 is already exploited

Security

SonicWall patches CVSS 10.0 SSRF in SMA1000 as exploits hit decoys two days later

Security

Ni8mare in n8n: CVSS 10.0 flaw lets one webhook request take over a server

Dockhand CVE-2026-53988: CVSS 10.0 unauthenticated webhook auth bypass

SonicWall SMA 1000 flaw rated CVSS 10.0 is already exploited

SonicWall patches CVSS 10.0 SSRF in SMA1000 as exploits hit decoys two days later

Azure AI Foundry flaw with CVSS 10.0 was patched in about two hours