CVE-2026-21858: n8n form workflows allow unauthenticated file access

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityCVSS 10.0 with no authentication or interaction required and very high EPSS, so exploitation is both easy and likely.

What it is

n8n versions from 1.65.0 up to but not including 1.121.0 fail to properly validate input in certain form-based workflows, letting an attacker read files on the underlying server. Because the flaw is reachable without authentication and can expose sensitive data, it is a serious risk for any internet-facing n8n instance running an affected workflow.

Impact

An unauthenticated remote attacker can read arbitrary files on the host, exposing credentials, configuration and other sensitive data, and may achieve further compromise depending on the deployment and workflows in use.

Attack surface

Reached over the network through a vulnerable form-based workflow; the CVSS vector shows no privileges or user interaction required, so any exposed instance with such a workflow is directly attackable.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.78447, 99.56th percentile) and a third-party advisory is tagged as an exploit, indicating public exploit activity is likely.

What to do

• Upgrade n8n to version 1.121.0 or later immediately.
• If patching is delayed, disable or restrict form-based workflows and remove unauthenticated access to the n8n instance.
• Place n8n behind authentication and network controls so it is not directly reachable from the internet.
• Rotate any credentials or secrets stored on or accessible from the n8n host after exposure is suspected.
• Monitor vendor advisory GHSA-v4pr-fm98-w9pg for updates.

Detection

• Review n8n logs for anomalous requests to form workflow endpoints, especially file-path-like parameters.
• Alert on unexpected reads of sensitive files (e.g., /etc/passwd, .env, config files) by the n8n process.
• Audit exposed n8n instances for form-based workflows and unauthenticated reachability.
• Correlate outbound connections or file access from the n8n host with unusual workflow executions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.