CVE-2026-21858 Ni8mare File Read

Overview

This workflow takes a list of self-hosted workflow-automation hosts and tells you which of them sit inside the CVE-2026-21858 (Ni8mare) range. Ni8mare is an unauthenticated arbitrary file read on a public form webhook, scored CVSS 10.0 by the GitHub CNA under GHSA-v4pr-fm98-w9pg. Versions from 1.65.0 up to but not including 1.121.0 are in range; 1.121.0 is the floor the graph treats as patched. The detect node is a GET of /rest/settings, with /healthz and the landing page as fallbacks. It reads the advertised version and classifies each host as AFFECTED, PATCHED, NOT_AFFECTED, version_unknown, or not the product. Hosts you mark with a form path can then take an optional canary that only runs after that AFFECTED flag. The canary does not steal credentials and does not run commands. Point the list at scope you are authorised to test and treat the version flag as the ticket for exposure management.

Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first. CVE-2026-21858 is not on the CISA Known Exploited Vulnerabilities list as of 17 September 2026.

Pipeline

1. targets reads the host file, or writes https://example.com when none is attached. Each row is a base URL plus an optional form path.
2. detect GETs /rest/settings on each host and reads the advertised version. /healthz and the landing page are fallbacks when that oracle is closed. Each row is classified against the 1.65.0 to 1.121.0 range.
3. poc runs only when status is AFFECTED and a form path is set. It is a canary against a public form endpoint on hosts you marked. Rows without a form path, or rows that are not AFFECTED, are skipped.
4. summary writes counts by status, canary outcome, and the AFFECTED subset.

Inputs

• Target file. URLs or JSONL with url / host and optional form_path, one per line. form_path is the path of an active form workflow you are authorised to test. Leave it empty to skip the canary. If no file is attached, the default is https://example.com.

Outputs

• n8n_findings.jsonl. One detect row per host: target, version, CVE-2026-21858 status, and the evidence string from the version oracle.
• ni8mare_poc.jsonl. The detect row plus canary fields: whether it ran, and skipped_not_affected or skipped_no_form_path when it did not.
• summary.jsonl. One object: targets checked, status counts, canary counts, the AFFECTED subset, and the fixed version 1.121.0.

Integrations

• HTTP. Unauthenticated GET to /rest/settings, /healthz, and the landing page. The canary is a separate request to a form endpoint you named, and only after an AFFECTED flag.

Sample output

The records below are from a completed run on 17 September 2026 against the default host, example.com. The version oracle did not see the product, so the canary did not run.

detect

poc

summary

{"cve": "CVE-2026-21858", "alias": "Ni8mare", "product": "n8n", "affected_range": "1.65.0 <= version < 1.121.0", "fixed_in": "1.121.0", "targets_checked": 1, "status_counts": {"not_n8n": 1}, "poc_mode": "canary_non_intrusive", "poc_result_counts": {"skipped_not_affected": 1}, "affected_targets": [], "detection_method": "unauthenticated GET /rest/settings (version oracle) + non-intrusive canary PoC (single read of /etc/hostname via the form endpoint)", "generated_at": "2026-09-17T20:58:10Z"}

FAQ

Which versions does this flag as AFFECTED?

1.65.0 through the last 1.120.x build. 1.121.0 and later is PATCHED. Builds older than 1.65.0 are NOT_AFFECTED. A closed version oracle comes back version_unknown or not the product, not AFFECTED.

Does an AFFECTED row mean the file-read fired?

No. AFFECTED is a version match against the range table. The canary is a second step, and it only runs when you set a form path on that host. Treat AFFECTED as patch-lag until the canary confirms.

When does the canary run?

Only when detect returned AFFECTED and the row has a non-empty form path. Missing form path is skipped_no_form_path. Any other status is skipped_not_affected. The canary is a proof of file read on a host you named. It does not take credentials and does not run a command.

Is this check safe on production?

The version oracle is read-only GET. The canary is skipped unless you opt a host in with a form path. Run it only against scope you are authorised to test.

Does a confirmed canary mean remote code execution?

No. A confirmed canary is evidence the form endpoint returned a file-read. The graph stops there. It does not read secrets, forge a session, or execute a command.

Related workflows

• Next.js Known CVE Scanner. Reach for this instead when the product is Next.js and you need version-qualified checks on those advisories, not a Ni8mare form-webhook flag.
• WordPress Pre-Auth RCE (CVE-2026-63030). Reach for this instead when the product is WordPress and you need a confirmed injection chain.
• UniFi OS Path Traversal (CVE-2026-34909). Reach for this instead when the next version-then-confirm flag is a UniFi console, not a form webhook.