Industry Newsremote code executionwebhooksn8nself hosted
n8n Exposes Servers To Remote Code Execution
|
10.0
Cyera researchers disclosed a maximum-severity unauthenticated remote code execution flaw in n8n, tracked as CVE-2026-21858 with CVSS 10.0, affecting an estimated 100,000 servers. The bug, dubbed "ni8mare", exploits webhook Content-Type confusion to overwrite internal variables and read arbitrary files; n8n released a patch in version 1.121.0 on Nov 18, 2025. Organizations must patch immediately to protect API keys and connected systems.
Scoring Rationale
High severity and wide exposure with official vendor patch; actionable remediation mitigates significant operational and credential risk.
Practice interview problems based on real data
1,500+ SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
