templated/CVE-2026-21858

n8n/CVE-2026-21858/README.md

@@ -0,0 +1,102 @@
+# n8n - Unauthenticated File Access via Form Workflows (CVE-2026-21858)
+
+A critical vulnerability exists in n8n (versions starting with 1.65.0 and below 1.121.0) that enables an unauthenticated remote attacker to access files on the underlying server through execution of certain form-based workflows. A vulnerable workflow can expose sensitive information stored on the system and may enable further compromise depending on deployment configuration and workflow usage.
+
+
+## Vulnerable Version
+### Setup
+Start n8n version 1.116.0 (`n8n-vulnerable`) on port `5678`:
+
+```sh
+docker compose up -d n8n-vulnerable
+```
+
+### Testing the vulnerability
+
+1. Verify that the n8n web interface is reachable on port `5678`:
+
+```sh
+curl -i http://localhost:5678/
+```
+
+Response:
+```http
+HTTP/1.1 200 OK
+Content-Type: text/html; charset=utf-8
+
+<!DOCTYPE html>
+<html lang="en">
+	<head>
+		...
+		<title>n8n.io - Workflow Automation</title>
+		...
+	</head>
+	<body>
+		<div id="app"></div>
+	</body>
+</html>
+```
+
+2. Send an unauthenticated `GET` request to `/rest/settings` to confirm the vulnerable n8n version (`1.65.0` to `< 1.121.0`):
+
+```sh
+curl -i http://localhost:5678/rest/settings
+```
+
+Response:
+```http
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+
+{"data":{"inE2ETests":false,"isDocker":true,"databaseType":"sqlite","endpointForm":"form",...,"versionCli":"1.116.0","releaseChannel":"stable",...}}
+```
+
+
+## Safe Version
+### Setup
+Start n8n version 1.121.0 (`n8n-patched`) on port `5679`:
+
+```sh
+docker compose up -d n8n-patched
+```
+
+### Testing the vulnerability
+
+1. Verify that the n8n web interface is reachable on port `5679`:
+
+```sh
+curl -i http://localhost:5679/
+```
+
+Response:
+```http
+HTTP/1.1 200 OK
+Content-Type: text/html; charset=utf-8
+
+<!DOCTYPE html>
+<html lang="en">
+	<head>
+		...
+		<title>n8n.io - Workflow Automation</title>
+		...
+	</head>
+	<body>
+		<div id="app"></div>
+	</body>
+</html>
+```
+
+2. Send the same `GET` request to `/rest/settings` on the patched instance:
+
+```sh
+curl -i http://localhost:5679/rest/settings
+```
+
+Response:
+```http
+HTTP/1.1 200 OK
+Content-Type: application/json; charset=utf-8
+
+{"data":{"settingsMode":"public",...,"versionCli":"1.121.0","releaseChannel":"stable",...}}
+```
+

n8n/CVE-2026-21858/docker-compose.yml

@@ -0,0 +1,34 @@
+version: '3.8'
+
+volumes:
+  vulnerable_storage:
+  patched_storage:
+
+services:
+  # Vulnerable instance for testing/analysis (CVE-2026-21858)
+  n8n-vulnerable:
+    image: n8nio/n8n:1.116.0
+    container_name: n8n-cve-2026-21858-lab
+    restart: unless-stopped
+    ports:
+      - "5678:5678"
+    environment:
+      - N8N_HOST=localhost
+      - WEBHOOK_URL=http://localhost:5678/
+      - NODE_ENV=development
+    volumes:
+      - vulnerable_storage:/home/node/.n8n
+
+  # Patched secure instance (1.121.0 or later)
+  n8n-patched:
+    image: n8nio/n8n:1.121.0
+    container_name: n8n-secure-lab
+    restart: unless-stopped
+    ports:
+      - "5679:5678"
+    environment:
+      - N8N_HOST=localhost
+      - WEBHOOK_URL=http://localhost:5679/
+      - NODE_ENV=development
+    volumes:
+      - patched_storage:/home/node/.n8n