--- title: "CVE-2026-21858 Ni8mare File Read" canonical: https://trickest.com/library/ni8mare-file-read-check-cve-2026-21858 description: "Version-classify self-hosted workflow-automation hosts for CVE-2026-21858 (Ni8mare) and optionally confirm a form-endpoint canary on hosts you own." --- # CVE-2026-21858 Ni8mare File Read ## Overview This workflow takes a list of self-hosted workflow-automation hosts and tells you which of them sit inside the CVE-2026-21858 (Ni8mare) range. Ni8mare is an unauthenticated arbitrary file read on a public form webhook, scored CVSS 10.0 by the GitHub CNA under GHSA-v4pr-fm98-w9pg. Versions from 1.65.0 up to but not including 1.121.0 are in range; 1.121.0 is the floor the graph treats as patched. The detect node is a GET of `/rest/settings`, with `/healthz` and the landing page as fallbacks. It reads the advertised version and classifies each host as AFFECTED, PATCHED, NOT_AFFECTED, version_unknown, or not the product. Hosts you mark with a form path can then take an optional canary that only runs after that AFFECTED flag. The canary does not steal credentials and does not run commands. Point the list at scope you are authorised to test and treat the version flag as the ticket for [exposure management](/use-cases/exposure-management). Run it on a schedule when the estate changes. New hosts and delayed patch windows are the reason the same check is worth more the second week than the first. CVE-2026-21858 is not on the CISA Known Exploited Vulnerabilities list as of 17 September 2026. ## Pipeline 1. `targets` reads the host file, or writes `https://example.com` when none is attached. Each row is a base URL plus an optional form path. 2. `detect` GETs `/rest/settings` on each host and reads the advertised version. `/healthz` and the landing page are fallbacks when that oracle is closed. Each row is classified against the 1.65.0 to 1.121.0 range. 3. `poc` runs only when status is AFFECTED and a form path is set. It is a canary against a public form endpoint on hosts you marked. Rows without a form path, or rows that are not AFFECTED, are skipped. 4. `summary` writes counts by status, canary outcome, and the AFFECTED subset. ## Inputs - **Target file.** URLs or JSONL with `url` / `host` and optional `form_path`, one per line. `form_path` is the path of an active form workflow you are authorised to test. Leave it empty to skip the canary. If no file is attached, the default is `https://example.com`. ## Outputs - **`n8n_findings.jsonl`.** One detect row per host: target, version, CVE-2026-21858 status, and the evidence string from the version oracle. - **`ni8mare_poc.jsonl`.** The detect row plus canary fields: whether it ran, and `skipped_not_affected` or `skipped_no_form_path` when it did not. - **`summary.jsonl`.** One object: targets checked, status counts, canary counts, the AFFECTED subset, and the fixed version 1.121.0. ## Integrations - HTTP. Unauthenticated GET to `/rest/settings`, `/healthz`, and the landing page. The canary is a separate request to a form endpoint you named, and only after an AFFECTED flag. ## Sample output The records below are from a completed run on 17 September 2026 against the default host, example.com. The version oracle did not see the product, so the canary did not run. ### `detect` ```jsonl {"target": "https://example.com", "checked_url": "https://example.com", "form_path": "", "product": "unknown", "version": "", "cve": "CVE-2026-21858", "status": "not_n8n", "evidence": "no n8n markers (settings/healthz/landing)", "note": "version-based detection only; exploitation additionally requires an active form workflow (Extract-from-File style)", "checked_at": "2026-09-17T20:57:58Z"} ``` ### `poc` ```jsonl {"target": "https://example.com", "checked_url": "https://example.com", "form_path": "", "product": "unknown", "version": "", "cve": "CVE-2026-21858", "status": "not_n8n", "evidence": "no n8n markers (settings/healthz/landing)", "note": "version-based detection only; exploitation additionally requires an active form workflow (Extract-from-File style)", "checked_at": "2026-09-17T20:57:58Z", "poc_mode": "canary_non_intrusive", "poc_attempted": false, "poc_result": "skipped_not_affected"} ``` ### `summary` ```json {"cve": "CVE-2026-21858", "alias": "Ni8mare", "product": "n8n", "affected_range": "1.65.0 <= version < 1.121.0", "fixed_in": "1.121.0", "targets_checked": 1, "status_counts": {"not_n8n": 1}, "poc_mode": "canary_non_intrusive", "poc_result_counts": {"skipped_not_affected": 1}, "affected_targets": [], "detection_method": "unauthenticated GET /rest/settings (version oracle) + non-intrusive canary PoC (single read of /etc/hostname via the form endpoint)", "generated_at": "2026-09-17T20:58:10Z"} ``` ## FAQ ### Which versions does this flag as AFFECTED? 1.65.0 through the last 1.120.x build. 1.121.0 and later is PATCHED. Builds older than 1.65.0 are NOT_AFFECTED. A closed version oracle comes back version_unknown or not the product, not AFFECTED. ### Does an AFFECTED row mean the file-read fired? No. AFFECTED is a version match against the range table. The canary is a second step, and it only runs when you set a form path on that host. Treat AFFECTED as patch-lag until the canary confirms. ### When does the canary run? Only when detect returned AFFECTED and the row has a non-empty form path. Missing form path is `skipped_no_form_path`. Any other status is `skipped_not_affected`. The canary is a proof of file read on a host you named. It does not take credentials and does not run a command. ### Is this check safe on production? The version oracle is read-only GET. The canary is skipped unless you opt a host in with a form path. Run it only against scope you are authorised to test. ### Does a confirmed canary mean remote code execution? No. A confirmed canary is evidence the form endpoint returned a file-read. The graph stops there. It does not read secrets, forge a session, or execute a command. ## Related workflows - [Next.js Known CVE Scanner](/library/nextjs-security-scanner). Reach for this instead when the product is Next.js and you need version-qualified checks on those advisories, not a Ni8mare form-webhook flag. - [WordPress Pre-Auth RCE (CVE-2026-63030)](/library/wordpress-wp2shell-pre-auth-rce). Reach for this instead when the product is WordPress and you need a confirmed injection chain. - [UniFi OS Path Traversal (CVE-2026-34909)](/library/unifi-os-path-traversal-check-cve-2026-34909). Reach for this instead when the next version-then-confirm flag is a UniFi console, not a form webhook. --- _Markdown source of https://trickest.com/library/ni8mare-file-read-check-cve-2026-21858._