Ni8mare (CVE-2026-21858): Patch n8n's CVSS 10.0 Webhook RCE and Rotate Your Credentials

Introduction

If you self-host n8n, there is one vulnerability you should treat as an emergency even now: Ni8mare, tracked as CVE-2026-21858, is a CVSS 10.0 unauthenticated remote code execution flaw in n8n’s webhook request parsing. One crafted webhook request could read arbitrary files from the server, steal the session encryption secret, forge an administrator session, and end with full server takeover. The fix shipped in n8n 1.121.0, yet recent internet scans still count nearly 60,000 unpatched instances. This guide shows you how to check whether your instance is in the affected range, upgrade on Docker, npm, and queue mode, verify the fix landed, and rotate every credential that a file-read bug may have exposed. It is written for anyone who administers their own n8n, from a single Docker container on a VPS to a multi-worker cluster. If you installed n8n with our Ubuntu VPS install guide, start at Step 1.

Quick answer

Upgrade self-hosted n8n to version 1.121.0 or later to fix Ni8mare (CVE-2026-21858), a CVSS 10.0 unauthenticated RCE in webhook body parsing that affects versions 1.65.0 through 1.120.x. There is no workaround, so patch first, then rotate all credentials.

Evidence

Start with the researchers who found it. Cyera’s research page, authored by Dor Attias of Cyera Research Labs, states: “We discovered a critical vulnerability (CVE-2026-21858, CVSS 10.0) in n8n that enables attackers to take over locally deployed instances, impacting an estimated 100,000 servers globally. No official workarounds are available for this vulnerability. Users should upgrade to version 1.121.0 or later to remediate the vulnerability.” That is the whole incident in three sentences: the severity is maximal, the exposure was global, and patching is the only fix. The full technical analysis is published on the Cyera research page for Ni8mare.

The timeline shows how fast the vendor moved once told. Attias reported the flaw to n8n’s security team on 9 November 2025, n8n shipped the fix in version 1.121.0 on 18 November 2025, nine days later, the CVE identifier was assigned on 6 January 2026, and Cyera published its full write-up on 7 January 2026 with n8n’s formal advisory following on 8 January. Nine days from report to patched release is a fast response for a flaw of this size, and it is documented in the official n8n security advisory GHSA-v4pr-fm98-w9pg.

The affected range is precise, per the NVD entry: versions starting with 1.65.0 and below 1.121.0. The CNA-published CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N, which decodes to network-exploitable, low attack complexity, no privileges required, no user interaction, with full confidentiality and integrity impact. That vector is why the score hits 10.0.

The reason this still matters in October 2026 is patch lag. Recent internet scans tracked by Shadowserver and reported by TechRadar, citing Censys data, estimate nearly 60,000 internet-facing n8n instances are still running unpatched versions, as of October 2026. Self-hosted n8n is frequently exposed on port 5678 with public webhook URLs, so a large share of those 60,000 instances are reachable by anyone. A compromised n8n is a crown-jewels incident: the instance holds the API keys, database credentials, and OAuth tokens for every connected service.

At a conceptual level, the bug is a Content-Type confusion in the middleware that parses incoming webhook and form-trigger requests. Under specific conditions the parser failed to validate the Content-Type header correctly, letting a crafted request override internal file references and turning a webhook endpoint into an unauthenticated arbitrary file read. From there the reported chain is: read the local database and config files, recover the secret used to sign session cookies, forge a valid administrator session, and create a workflow with an Execute Command node that runs arbitrary OS commands on the host. I describe the chain at this level deliberately: everything a defender needs to understand the urgency is here, and nothing here helps an attacker beyond what the public advisories already say.

Prerequisites

• A self-hosted n8n instance you administer (Docker Compose, plain Docker, npm install, or queue mode). n8n Cloud users are patched by n8n and can skip this guide.
• Shell access to the machine running n8n, or access to its docker-compose.yml.
• A current backup of workflows and credentials. If you do not have one, follow the backup section of our self-hosted n8n update guide before touching anything.
• About 30 minutes of maintenance window: the upgrade takes under ten, verification and credential rotation take the rest.

Step 1: Check whether your version is in the affected range

You are vulnerable if your version is 1.65.0 or later but older than 1.121.0. Anything on the 2.x line already contains the fix. Check the running version three ways and trust the lowest number you find.

In the editor, open Settings, then About. The version is shown at the top of the page.

On the command line, for an npm install:

n8n --version

On Docker Compose, run it inside the container so you see the running image rather than anything installed on the host:

docker compose exec n8n n8n --version

Also confirm the image tag pinned in your docker-compose.yml matches what is actually running. A tag like n8nio/n8n:1.118.0 in the file with a stale running container is a common source of confusion; the running container is what matters.

While you are here, check exposure. On the host, list listening ports:

ss -tlnp | grep 5678

If the output shows 0.0.0.0:5678, other machines can reach n8n directly. With Docker, a published port like -p 5678:5678 is reachable from the internet on a VPS with no firewall in front, and Docker-published ports bypass ufw and firewalld rules on Linux. Bind it to localhost instead (-p 127.0.0.1:5678:5678) and put a reverse proxy with TLS in front, so only the webhook paths outside services actually need to call stay public.

Step 2: Back up workflows and credentials

Do this before every security upgrade. Export everything from the CLI so the backup is independent of the web UI:

docker compose exec n8n n8n export:workflow --all --output=/tmp/workflows-backup.json
docker compose exec n8n n8n export:credentials --all --decrypted --output=/tmp/credentials-backup.json
docker cp n8n:/tmp/workflows-backup.json ./workflows-backup-2026-10-19.json
docker cp n8n:/tmp/credentials-backup.json ./credentials-backup-2026-10-19.json

For an npm install, run the same n8n export: commands directly on the host. Store the credentials export somewhere safe: it contains decrypted secrets by design, so treat the file like a password vault and delete it after the rotation in Step 6 is done.

Step 3: Upgrade on Docker Compose

This is the most common self-hosted layout. Pin the image to a fixed, patched release rather than latest so future pulls are predictable:

services:
  n8n:
    image: n8nio/n8n:1.121.0

Then pull and recreate:

docker compose pull
docker compose up -d
docker compose logs -f n8n

Watch the logs until you see the startup line confirming the new version and the database migrations completing. A typical healthy tail looks like:

n8n-1  | n8n ready on 0.0.0.0, port 5678
n8n-1  | Version: 1.121.0

If you run queue mode, upgrade every component to the same version in one window: the main instance, all workers, and the webhook processor. Version skew between main and workers produces cryptic job failures, so do not leave a worker on the old image “because it is only a worker”; the webhook parser fix must be present on whichever process handles the HTTP request.

Step 4: Upgrade on npm

For a direct npm install, update the global package and restart the process:

npm update -g n8n
n8n --version

Confirm the printed version is 1.121.0 or later, then restart n8n under your process manager (pm2, systemd, or however you run it):

pm2 restart n8n

or, for systemd:

sudo systemctl restart n8n

Then open the editor and re-check Settings, About. The number there must match the CLI output.

Step 5: Verify the patch and close the exposure

Verification has three parts: version, parser behavior, and exposure.

First, re-run the version checks from Step 1. All three must agree on 1.121.0 or later. If the editor still shows the old version after a Docker upgrade, you are almost certainly looking at a stale browser cache or the old container is still running; run docker compose ps and confirm the container was actually recreated.

Second, confirm the instance is no longer reachable in ways you did not intend. Re-run the port check from Step 1 and confirm n8n listens only where you expect. If you use a reverse proxy, verify the proxy is the only path from the internet and that direct access to port 5678 from outside is refused. External scanners such as Shodan or Censys can confirm what the internet sees; search for your host and check whether 5678 is listed.

Third, look for signs of prior compromise while you have the maintenance window. In the editor, review the user list, API keys, and the workflow list for anything you do not recognize, and scan recent executions for runs you cannot explain. Remember the caveat from the FAQ: a pure file read leaves no reliable trace, so a clean log does not prove you were never touched. If the instance was internet-facing on a vulnerable version, proceed to Step 6 regardless.

Step 6: Rotate every credential the file read could have exposed

This is the step most guides skip and the one that actually closes the incident. Ni8mare’s primitive is an arbitrary file read, and the reported chain specifically includes reading the n8n database and the config file holding the session encryption secret. Treat every secret stored in or reachable from that instance as potentially copied.

Work through this list in order:

1. API keys and OAuth tokens in n8n credentials. Start with the ones that can send email, move money, or reach production systems: SMTP, Stripe, AWS, database passwords, GitHub tokens. Rotate each at the provider, then update the credential in n8n and test the connection.
2. n8n user passwords and API keys. Reset passwords for every n8n user and regenerate any personal API keys under Settings.
3. The n8n encryption key. If N8N_ENCRYPTION_KEY was set, generate a new value, update the environment, and re-import credentials so they are re-encrypted under the new key. Export with --decrypted first (you already have the backup from Step 2), change the key, restart, and re-import. If the key was auto-generated and stored in the config file, that file was readable through the bug, so rotate it the same way.
4. Webhook secrets and external callback tokens. Any static secret embedded in webhook URLs or headers that outside services use to call your workflows should be regenerated, because URL paths are exactly what an attacker probing webhooks would have seen.

Delete the decrypted credentials export from Step 2 once rotation is complete.

Troubleshooting

The container fails to start after upgrading to 1.121.0. The usual cause is a database migration problem, most often a PostgreSQL version too old for the migration scripts in the new release. Check the failure with docker compose logs n8n and look for migration errors near the top. Fix the database first (upgrade Postgres to a supported version), restore from the pre-upgrade backup if the data directory was touched, then re-run the upgrade. Never delete the data volume to “fix” a failed migration; that deletes your workflows.

n8n shows “error decrypting credentials” or the encryption key mismatch error after restart. This means the running instance cannot read the configured N8N_ENCRYPTION_KEY, or the key differs from the one used when the credentials were saved. Compare the key in your environment file or secrets manager with the one the container actually receives (docker compose exec n8n env | grep N8N_ENCRYPTION_KEY). Restore the original key value, restart, and only then perform the planned rotation from Step 6. Rotating onto a broken key state makes recovery harder.

Webhooks return 404 after the upgrade. This is usually a WEBHOOK_URL misconfiguration surfacing after the recreate, not a regression from the security fix. Confirm the WEBHOOK_URL environment variable matches your public address exactly, including the https:// scheme and no trailing slash, then restart. Test with a simple Webhook-trigger workflow and check the production URL, not the test URL, which only listens while the editor test is running.

Queue workers throw version-mismatch or job-format errors after the main instance was upgraded. You upgraded main but left workers on the old image. Bring every worker, the webhook processor, and main to the identical version, then restart the whole stack together. Mixed-version queue clusters are unsupported and the parser fix must be present on the process that terminates the HTTP request.

FAQ

The FAQ entries above cover the questions readers ask most: Cloud exemption, the 2.x line, the absence of a workaround, detecting prior compromise, upgrade breakage risk, and why credential rotation is mandatory even with clean logs.

Conclusion

Ni8mare is the textbook case for patching self-hosted automation fast: a CVSS 10.0 unauthenticated RCE, a nine-day vendor turnaround, no workaround, and nearly 60,000 instances still exposed months later because nobody scheduled the upgrade. Check your version, upgrade to 1.121.0 or later, verify the running build, close the network exposure, and rotate every credential. Then make version checks a routine: the October 2026 advisory batch that followed fixed 14 more advisories, and our October 2026 security bulletin patch guide plus the September 2026 security advisories checklist cover those rounds step by step. Pair this fix with our single-CVE walkthrough for CVE-2026-44791 to build a repeatable patch routine instead of a panic.

Frequently asked questions