Preliminary research

Ni8mare: Unauthenticated Remote Code Execution in n8n (CVE-2026-21858)

Dor Attias · Cyera Research Labs · 1 October 2026

AI-collected research leads through 2 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Shows how an n8n form webhook's content-type-dependent parsers let JSON forge the uploaded-file structure and copy arbitrary local files into a workflow. Reading the user database and signing secret enables administrator-session forgery, after which a command node provides remote code execution.

Record

Researcher

Dor Attias

Published by

Cyera Research Labs

Date

1 October 2026

In the archive

• Collected in the 2026 preliminary research sweep

Tags

• content-type
• parser-differential
• file-read
• auth-bypass
• session
• nodejs
• attack-chain
• rce
• owasp-a01-2021
• owasp-a05-2021

This page is the archive's own catalogue record. The research is the work of Dor Attias, first published at the original source. Preserved copies are kept so the citation survives its host.