On January 7, 2026, security researchers at Cyera disclosed CVE-2026-21858 - a critical vulnerability in n8n, the popular workflow automation platform. The flaw carries a perfect CVSS score of 10.0 and enables unauthenticated attackers to fully take over vulnerable instances.

The researchers dubbed it “Ni8mare” - and for good reason.

What is n8n?

n8n has become the backbone of automation infrastructure in the AI era. It’s a workflow automation platform that lets users - even non-technical ones - build complex automations with a drag-and-drop interface.

Think of it as the plumbing that connects AI agents to the rest of your infrastructure: triggering workflows from form submissions, processing files with AI models, pushing data to CRMs, sending notifications, orchestrating multi-step agent pipelines.

With over 100 million Docker pulls and thousands of enterprise deployments, n8n sits at the intersection of everything - your data, your APIs, your AI models.

Which makes it an extremely attractive target.

The Vulnerability

The attack exploits a content-type confusion bug in how n8n handles file uploads. Here’s the chain:

The attack works because:

1. No authentication required - The Form Trigger webhook is designed to accept external input. That’s its job.

2. Content-Type confusion - By changing the Content-Type header from multipart/form-data to application/json, attackers can control the req.body.files object.

3. Path traversal - With control over the file path parameter, attackers can read any local file from the system instead of the uploaded file.

4. Session hijacking - n8n stores session cookies that can be reconstructed from accessible files, leading to full remote code execution.

The Bigger Picture

This isn’t just another CVE. It’s a symptom of something deeper.

n8n joins a growing list of workflow automation platforms with critical vulnerabilities this year:

We wrote about this pattern earlier this month in The Sandbox Illusion - workflow automation platforms are agentic infrastructure wearing a low-code costume.

Why This Keeps Happening

The fundamental problem: we’re bolting AI onto infrastructure designed for humans.

n8n was built to automate workflows. File uploads were designed for humans uploading documents. The trust model assumes the entity interacting with forms is a person who made a mistake, not an adversary crafting malicious payloads.

But when you put a Form Trigger in front of an AI pipeline that processes documents, executes code, and connects to your production systems, you’ve created something new - an attack surface that combines:

• External accessibility - Webhooks and forms are meant to be public
• Code execution capability - The whole point is automation
• System access - Workflows connect to databases, APIs, cloud services
• No security boundary - The “sandbox” is often just a TypeScript type system

This is the infrastructure gap. These platforms have become the de facto operating layer for AI agents, but they weren’t designed with adversarial AI interactions in mind.

What Should You Do?

For Security Teams

1. Inventory your workflow automation - Do you know every n8n, Zapier, Make, or custom automation instance in your environment?

2. Treat workflows as code - These aren’t just “no-code tools” - they’re executing logic with system access. Apply the same security review you’d give to any production code.

3. Monitor for behavioral anomalies - File access patterns, unusual webhook calls, unexpected network connections from automation infrastructure.

4. Assume breach at the edge - If your automation platform accepts external input and connects to internal systems, assume attackers are probing it.

The Infrastructure Question

Every company shipping AI agents on infrastructure built for pre-AI workflows is running the same experiment.

We keep assuming that tools designed for human operators - with human reaction times, human error patterns, human trust models - will work fine when we replace the human with an AI agent that can make thousands of decisions per second.

CVE-2026-21858 is what happens when that assumption meets reality.

The n8n team responded quickly and responsibly. But the vulnerability class - content-type confusion in file handling - isn’t unique to n8n. It’s a pattern waiting to be discovered in workflow automation platforms everywhere.

The question isn’t whether your automation infrastructure has similar vulnerabilities. It’s whether you’ll find them before attackers do.

References:

• Cyera Research Labs - Ni8mare Disclosure
• n8n Security Advisory GHSA-v4pr-fm98-w9pg
• NVD - CVE-2026-21858