Ni8mare: Critical n8n Automation Platform Flaw Enables Complete System Takeover Without Authentication

The popular workflow automation platform n8n faces yet another maximum-severity security crisis as researchers from Cyera Research Labs reveal a devastating vulnerability enabling complete instance compromise without authentication. The flaw, assigned CVE-2026-21858 and nicknamed Ni8mare, received the highest possible CVSS rating of 10.0.

Security researcher Dor Attias initially reported the weakness on November 9, 2025. The platform maintainers acknowledged that successful exploitation could expose sensitive information stored on affected systems and potentially enable broader infrastructure compromise depending on deployment configurations.

Four Critical Flaws in Two Weeks

Ni8mare represents the fourth critical vulnerability disclosed in n8n within an exceptionally short timeframe, raising serious concerns about the platform's security posture:

What distinguishes Ni8mare from its predecessors is the complete absence of authentication requirements—attackers need no credentials whatsoever to compromise vulnerable systems.

Content-Type Confusion Attack Chain

When the platform receives data, a parsing function examines the Content-Type header to determine how to handle the request body. Requests marked as multipart/form-data trigger a file upload parser, while other content types follow a standard body parsing path.

The critical weakness emerges when file-handling functions execute without verifying the actual content type. Attackers can manipulate the request structure to override internal file path parameters, enabling them to read arbitrary files from the server.

Catastrophic Blast Radius for Enterprise Deployments

Workflow automation platforms occupy uniquely privileged positions within organizational infrastructure. A compromised n8n instance doesn't merely expose a single application—it potentially surrenders access to every integrated system and service.

API credentials, OAuth tokens, database connection strings, cloud storage configurations, and countless other sensitive secrets flow through these automation hubs. Attackers gaining control effectively inherit the combined permissions of every connected service, transforming a single vulnerability into enterprise-wide compromise.

Organizations exposing n8n instances to the internet face immediate risk, though internal deployments remain vulnerable to lateral movement attacks once adversaries establish initial network access.

Immediate Actions Required

Current stable releases include 1.123.10, 2.1.5, 2.2.4, and 2.3.0. Both self-hosted deployments and n8n Cloud instances require attention.