Critical n8n Vulnerability Affects Self Hosted Instances Versions 1.65.0 to 1.120.4 CVE 2026 21858
VIBE CODERS: CHECK YOUR N8N ACCOUNT IF YOU’RE SELF-HOSTING YOUR N8N Critical Vulnerability: CVE-2026-21858 (Ni8mare) Public disclosure: January 9, 2036 N8N notified: mid-November, 2025 **n8n instances hosted and managed directly by n8n are not affected. CVE-2026-21858, nicknamed Ni8mare, affects self-hosted n8n instances 1.65.0 through 1.120.4, and carries a CVSS severity score of 10.0.** 26,512 Actively Exposed Self-Hosts: Real-time scanning data from Censys in early January identified 26,512 n8n instances currently reachable via the public internet. These specific hosts are at the highest immediate risk of exploitation because they can be targeted by unauthenticated remote requests. According to Cyera Research Labs, with analysis and reporting published by n8n (official security advisory), The Hacker News, Censys, Security Affairs, and CSO Online, a critical security vulnerability identified as CVE-2026-21858, nicknamed Ni8mare, affects self-hosted n8n instances 1.65.0 through 1.120.4, and carries a CVSS severity score of 10.0. If you are running a self-hosted n8n instance, you should immediately determine whether you are affected by this vulnerability and take corrective action. If: • Your n8n instance is self-hosted (Docker, VPS, cloud VM, on-prem) • Your n8n version is earlier than 1.121.0 • The instance is reachable from the internet (webhooks, forms, or direct UI access) Go to: In the n8n dashboard, go to Help → About and confirm the version number Or on the server, run: n8n –version If the version is below 1.121.0, your instance is vulnerable and must be updated immediately. Immediate remediation steps: 1. Upgrade n8n to version 1.121.0 or later without delay. 2. If the instance is publicly accessible, temporarily restrict external access to webhooks or forms until the upgrade is complete. 3. After upgrading, rotate sensitive credentials such as API keys, tokens, database passwords, and OAuth secrets as a precaution. Common upgrade paths: