Max severity Ni8mare flaw impacts nearly 60,000 n8n instances

A maximum-severity vulnerability (CVE-2026-21858, “Ni8mare”) in the n8n workflow automation platform allows unauthenticated remote attackers to hijack locally deployed instances—potentially exposing secrets, forging sessions, injecting files, or executing commands; researchers reported the flaw and Shadowserver found tens of thousands of exposed, unpatched instances worldwide, and admins are urged to upgrade to n8n 1.121.0+ or restrict public webhook/form endpoints.