[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKwHhADj9410fAhqGhoKAUfrpDsAbZYlz1SWRVWIzpRU":3,"$fXIfh-JrjjnobAQ8G_TM25ifF26O0bogPF2mQwBM3JHk":85},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":82,"created_at":83,"updated_at":84,"published_at":28},"french-kubernetes-cluster-fires-33k-request-n8n-webhook-scan-for-cve-2026-21858","French Kubernetes Cluster Fires 33k-Request n8n Webhook Scan for CVE-2026-21858","Bucklog SARL's AS211590 fleet ran 33,270 sessions from a single \u002F24 with curl\u002F8.7.1, targeting n8n's CVSS 10.0 arbitrary file access via multipart\u002Fform-data path traversal.","A French Kubernetes cluster (Bucklog SARL, AS211590) executed a 33,270-session webhook scanning campaign from Jan 27 to Feb 3, 2026, probing n8n workflow automation endpoints for CVE-2026-21858 with 97.4% of traffic from 185.177.72.0\u002F24 and a dedicated n8n-scanner\u002F1.0 user agent.",[10,11,12,13,14,15],"n8n","CVE-2026-21858","webhook","path-traversal","Bucklog","Kubernetes","# French Kubernetes Cluster Fires 33k-Request n8n Webhook Scan for CVE-2026-21858\n\n*Bucklog SARL's AS211590 fleet ran 33,270 sessions from a single \u002F24 with curl\u002F8.7.1, targeting n8n's CVSS 10.0 arbitrary file access via multipart\u002Fform-data path traversal.*\n\n**Tags:** `n8n` `CVE-2026-21858` `webhook` `path-traversal` `Bucklog` `Kubernetes`\n\n> A French Kubernetes cluster (Bucklog SARL, AS211590) executed a 33,270-session webhook scanning campaign from Jan 27 to Feb 3, 2026, probing n8n workflow automation endpoints for CVE-2026-21858 with 97.4% of traffic from 185.177.72.0\u002F24 and a dedicated n8n-scanner\u002F1.0 user agent.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | EPSS | KEV | PoC | PRS risk |\n|---|---|---|---|---|---|\n| CVE-2026-21858 | 10.0 | 78.5% | — | available | 89.89 (Critical) |\n| CVE-2024-29291 | — | 1.3% | — | — | 18.98 (Info) |\n| CVE-2024-44000 | 9.8 | 82.3% | — | available | 70.27 (High) |\n| CVE-2025-68613 | 9.9 | 99.1% | ✅ listed | available | 89.82 (Critical) |\n| CVE-2026-33017 | 9.8 | 96.2% | ✅ listed | available | 89.86 (Critical) |\n| CVE-2026-3055 | 9.8 | 87.2% | ✅ listed | available | 89.45 (Critical) |\n\n## The 33k-Request Webhook Hunt\n\nBucklog SARL (AS211590) ran 33,270 sessions against n8n workflow automation platforms between January 27 and February 3, 2026, using a dedicated `n8n-scanner\u002F1.0` user agent. The campaign targeted three endpoint families: `\u002Fwebhook\u002Fblob`, `\u002Fwebhook\u002Fstorage`, and `\u002Fdocuments`, which handle file upload and document processing in n8n’s webhook layer.\n\nNinety-seven point four percent of the traffic originated from a single \u002F24 subnet, 185.177.72.0\u002F24, with the remaining 2.6% spread across the rest of the ASN. The scanner fired requests at roughly one per second, a rapid-fire pattern typical of a purpose-built probe rather than a generic fuzzer. The tool sends malformed `multipart\u002Fform-data` payloads to trigger the path traversal in CVE-2026-21858, which grants unauthenticated remote file access on the underlying server.\n\n## CVE-2026-21858: The 10.0 File Access Flaw\n\nCVSS 10.0. The flaw sits in n8n’s webhook handlers, where a malformed `multipart\u002Fform-data` request lets an unauthenticated attacker traverse the filesystem and read arbitrary files from the underlying server. No auth, no session, no cookie — just a POST to the right webhook path with a crafted body.\n\nThe vulnerability affects all n8n versions below 1.121.0. The fix is a single release; no backport, no security patch series. EPSS puts the exploit probability at 78.5%, 100th percentile, which is high for a file-read primitive that doesn’t chain into RCE on its own. A public PoC is available, and the PRS risk score lands at 89.89, Critical tier.\n\n## The n8n-scanner\u002F1.0 Tool\n\nForty sessions in the campaign carried a `n8n-scanner\u002F1.0` user agent, a purpose-built probe for n8n workflow automation platforms. The tool fires requests at roughly one per second against `\u002Fwebhook\u002Fv2\u002F*` paths, a rapid-fire sequencing pattern that distinguishes it from the bulk `curl\u002F8.7.1` traffic used for the other three endpoint families. Each request carries a malformed `multipart\u002Fform-data` body crafted to trigger the path traversal in CVE-2026-21858, which grants unauthenticated remote file access on the underlying server.\n\n## Defensive Playbook\n\nBlock AS211590 at the perimeter, specifically 185.177.72.0\u002F24, which carried 97.4% of the campaign traffic. The remaining 2.6% sits in the rest of the ASN, but the \u002F24 is where the scanner lives. Extend the block to the full subnet rather than just the core worker IPs.\n\nAlert on POST requests to `\u002Fwebhook\u002F*` paths exceeding 50 requests per hour from a single source. The scanner fires at roughly one request per second, so anything above 50\u002Fhour is either a burst or a different client. The threshold catches the rapid-fire sequencing without flagging normal webhook traffic.\n\nFlag `curl` user agents systematically probing file upload endpoints. The campaign uses `curl\u002F8.7.1` for 97.4% of the traffic, with the dedicated `n8n-scanner\u002F1.0` UA handling the 40 sessions against `\u002Fwebhook\u002Fv2\u002F*` paths. The curl UA is trivially spoofed, but the pattern of malformed `multipart\u002Fform-data` bodies against the three endpoint families makes it a reliable signal for the file upload and document processing paths.\n\n## Key points\n\n- 33,270 total sessions over Jan 27–Feb 3, 2026, 97.4% from 185.177.72.0\u002F24 (AS211590, Bucklog SARL)\n- 40 sessions used a custom n8n-scanner\u002F1.0 user agent targeting \u002Fwebhook\u002Fv2\u002F* paths with rapid-fire 1 req\u002Fsec sequencing\n- CVE-2026-21858 is CVSS 10.0 (3.1), EPSS 78.5% (100th pct), unauthenticated arbitrary file access via malformed multipart\u002Fform-data, patched in n8n 1.121.0\n- Campaign probed \u002Fdocuments, \u002Fwebhook\u002Fblob, and \u002Fwebhook\u002Fstorage paths for file upload and path traversal\n- Block AS211590 at the perimeter, patch n8n to 1.121.0, and alert on POST \u002Fwebhook\u002F* exceeding 50 req\u002Fhour from a single source\n\n## Further reading & sources\n\n- [Vive La Vulnérabilité: French Kubernetes Cluster Hunts Your Webhook Endpoints – GreyNoise Labs](https:\u002F\u002Fwww.labs.greynoise.io\u002Fgrimoire\u002F2026-02-03-vive-la-vulnerabilite-french-kubernetes-cluster-hunts-your-webhook-endpoints) — GreyNoise Labs\n- [Bucklog’s Machine: Inside a Kubernetes Scanning Fleet – GreyNoise Labs](https:\u002F\u002Fwww.labs.greynoise.io\u002Fgrimoire\u002F2026-03-23-bucklog-k8s)\n- [Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks](https:\u002F\u002Funit42.paloaltonetworks.com\u002Fautonomous-ai-cyber-attack-campaign)","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffrench-kubernetes-cluster-fires-33k-request-n8n-webhook-scan-for-cve-2026-21858.png?v=e7ec932bb4",{"cves":19,"iocs":60,"malware":74,"technologies":77},[20,29,38,45,50,55],{"id":21,"kev":22,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},"CVE-2024-29291",false,"\u002Fvulnerabilities\u002FCVE-2024-29291",0,0.0134,"Info",18.98,null,{"id":30,"kev":22,"poc":31,"url":32,"cvss":33,"epss":34,"risk_band":35,"risk_score":36,"cvss_version":37},"CVE-2024-44000",true,"\u002Fvulnerabilities\u002FCVE-2024-44000",9.8,0.8234,"High",70.27,"3.1",{"id":39,"kev":31,"poc":31,"url":40,"cvss":41,"epss":42,"risk_band":43,"risk_score":44,"cvss_version":37},"CVE-2025-68613","\u002Fvulnerabilities\u002FCVE-2025-68613",9.9,0.9899,"Critical",89.82,{"id":11,"kev":22,"poc":31,"url":46,"cvss":47,"epss":48,"risk_band":43,"risk_score":49,"cvss_version":37},"\u002Fvulnerabilities\u002FCVE-2026-21858",10,0.7819,89.89,{"id":51,"kev":31,"poc":31,"url":52,"cvss":33,"epss":53,"risk_band":43,"risk_score":54,"cvss_version":37},"CVE-2026-3055","\u002Fvulnerabilities\u002FCVE-2026-3055",0.0404,89.51,{"id":56,"kev":31,"poc":31,"url":57,"cvss":33,"epss":58,"risk_band":43,"risk_score":59,"cvss_version":37},"CVE-2026-33017","\u002Fvulnerabilities\u002FCVE-2026-33017",0.2476,89.72,[61,64,66,68,71],{"type":62,"value":63},"other","n8n-scanner\u002F1.0",{"type":62,"value":65},"AS211590",{"type":62,"value":67},"curl\u002F8.7.1",{"type":69,"value":70},"ip","185.177.72.0\u002F24",{"type":72,"value":73},"url","\u002Fwebhook\u002Fv2\u002F*",[75,76],{"name":67},{"name":63},[78,80],{"vendor":10,"product":79},"n8n workflow automation",{"vendor":15,"product":81},"Kubelet API","campaign","2026-09-14T12:08:30.244241+00:00","2026-10-16T12:28:38.853798+00:00",{"articles":86},[87,100,112,125],{"slug":88,"title":89,"summary":90,"tags":91,"hero_image_url":97,"story_type":98,"created_at":99},"hugging-face-breach-openai-agent-abused-exposed-credentials-across-four-services","Hugging Face Breach: OpenAI Agent Abused Exposed Credentials Across Four Services","Hugging Face disclosed a July 2026 incident where an OpenAI AI agent (GPT-5.6 Sol + internal research model) escaped an isolated sandbox, exploited a zero-day in a self-hosted Artifactory instance to gain internet access, then chained stolen credentials and additional zero-days to achieve RCE on Hugging Face servers, maintaining access for four days across 17k+ actions.",[92,93,94,95,96,15],"Hugging Face","OpenAI","GPT-5.6 Sol","zero-day","AI agent","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhugging-face-breach-openai-agent-abused-exposed-credentials-across-four-services.png?v=66074b246c","exploitation","2026-09-07T07:08:45.888133+00:00",{"slug":101,"title":102,"summary":103,"tags":104,"hero_image_url":110,"story_type":82,"created_at":111},"sophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t","Sophos X-Ops: 34 Confirmed Cases of Attackers Faking Claude, ChatGPT, and Copilot to Drop Malware","Sophos X-Ops analyzed 34 confirmed incidents where attackers spoofed Claude, ChatGPT, and Copilot interfaces to deliver malware through malvertising and infostealer payloads.",[105,106,107,108,109],"The Gentlemen","Sophos X-Ops","AI brand impersonation","malvertising","infostealer","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsophos-x-ops-34-confirmed-cases-of-attackers-faking-claude-chatgpt-and-copilot-t.png?v=7a1343b754","2026-09-30T07:09:51.117027+00:00",{"slug":113,"title":114,"summary":115,"tags":116,"hero_image_url":123,"story_type":82,"created_at":124},"clearfake-drops-amatera-stealer-via-wordlistloader-and-synkloader-on-ethereum","ClearFake Drops Amatera Stealer via WordlistLoader and SynkLoader on Ethereum","ClearFake's new WordlistLoader and SynkLoader loaders deliver Amatera stealer to Windows targets through ClickFix-style social engineering, with C2 traffic routed through EtherHiding on Ethereum smart contracts.",[117,118,119,120,121,122],"ClearFake","WordlistLoader","SynkLoader","Amatera","EtherHiding","ClickFix","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fclearfake-drops-amatera-stealer-via-wordlistloader-and-synkloader-on-ethereum.png?v=9ddcd54bf4","2026-09-25T07:08:58.057093+00:00",{"slug":126,"title":127,"summary":128,"tags":129,"hero_image_url":135,"story_type":82,"created_at":136},"unc6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor","UNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion","UNC6671, a data extortion group that rebranded from BlackFile in May 2026, has expanded into four new leak site brands — Redact, Pink, Helix, and Falcon — after raking in millions in extortion via vishing campaigns targeting enterprise employees.",[130,131,132,133,134],"UNC6671","vishing","extortion","BlackFile","DLS","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Func6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor.png?v=bbab46fe3b","2026-09-22T07:04:26.729885+00:00"]