Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2026-21858 | 10.0 | 78.5% | — | available | 89.89 (Critical) |
| CVE-2024-29291 | — | 1.3% | — | — | 18.98 (Info) |
| CVE-2024-44000 | 9.8 | 82.3% | — | available | 70.27 (High) |
| CVE-2025-68613 | 9.9 | 99.1% | ✅ listed | available | 89.82 (Critical) |
| CVE-2026-33017 | 9.8 | 96.2% | ✅ listed | available | 89.86 (Critical) |
| CVE-2026-3055 | 9.8 | 87.2% | ✅ listed | available | 89.45 (Critical) |
The 33k-Request Webhook Hunt
Bucklog SARL (AS211590) ran 33,270 sessions against n8n workflow automation platforms between January 27 and February 3, 2026, using a dedicated n8n-scanner/1.0 user agent. The campaign targeted three endpoint families: /webhook/blob, /webhook/storage, and /documents, which handle file upload and document processing in n8n’s webhook layer.
Ninety-seven point four percent of the traffic originated from a single /24 subnet, 185.177.72.0/24, with the remaining 2.6% spread across the rest of the ASN. The scanner fired requests at roughly one per second, a rapid-fire pattern typical of a purpose-built probe rather than a generic fuzzer. The tool sends malformed multipart/form-data payloads to trigger the path traversal in CVE-2026-21858, which grants unauthenticated remote file access on the underlying server.
CVE-2026-21858: The 10.0 File Access Flaw
CVSS 10.0. The flaw sits in n8n’s webhook handlers, where a malformed multipart/form-data request lets an unauthenticated attacker traverse the filesystem and read arbitrary files from the underlying server. No auth, no session, no cookie — just a POST to the right webhook path with a crafted body.
The vulnerability affects all n8n versions below 1.121.0. The fix is a single release; no backport, no security patch series. EPSS puts the exploit probability at 78.5%, 100th percentile, which is high for a file-read primitive that doesn’t chain into RCE on its own. A public PoC is available, and the PRS risk score lands at 89.89, Critical tier.
The n8n-scanner/1.0 Tool
Forty sessions in the campaign carried a n8n-scanner/1.0 user agent, a purpose-built probe for n8n workflow automation platforms. The tool fires requests at roughly one per second against /webhook/v2/* paths, a rapid-fire sequencing pattern that distinguishes it from the bulk curl/8.7.1 traffic used for the other three endpoint families. Each request carries a malformed multipart/form-data body crafted to trigger the path traversal in CVE-2026-21858, which grants unauthenticated remote file access on the underlying server.
Defensive Playbook
Block AS211590 at the perimeter, specifically 185.177.72.0/24, which carried 97.4% of the campaign traffic. The remaining 2.6% sits in the rest of the ASN, but the /24 is where the scanner lives. Extend the block to the full subnet rather than just the core worker IPs.
Alert on POST requests to /webhook/* paths exceeding 50 requests per hour from a single source. The scanner fires at roughly one request per second, so anything above 50/hour is either a burst or a different client. The threshold catches the rapid-fire sequencing without flagging normal webhook traffic.
Flag curl user agents systematically probing file upload endpoints. The campaign uses curl/8.7.1 for 97.4% of the traffic, with the dedicated n8n-scanner/1.0 UA handling the 40 sessions against /webhook/v2/* paths. The curl UA is trivially spoofed, but the pattern of malformed multipart/form-data bodies against the three endpoint families makes it a reliable signal for the file upload and document processing paths.
Key points
- 33,270 total sessions over Jan 27–Feb 3, 2026, 97.4% from 185.177.72.0/24 (AS211590, Bucklog SARL)
- 40 sessions used a custom n8n-scanner/1.0 user agent targeting /webhook/v2/* paths with rapid-fire 1 req/sec sequencing
- CVE-2026-21858 is CVSS 10.0 (3.1), EPSS 78.5% (100th pct), unauthenticated arbitrary file access via malformed multipart/form-data, patched in n8n 1.121.0
- Campaign probed /documents, /webhook/blob, and /webhook/storage paths for file upload and path traversal
- Block AS211590 at the perimeter, patch n8n to 1.121.0, and alert on POST /webhook/* exceeding 50 req/hour from a single source