EQSTLab/CVE-2026-21858

GitHubRepository PoCExploit

PoC files

6 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Python script (poc.py) that exploits CVE-2026-21858 in n8n 1.120.4. It first extracts sensitive assets (encryption key, admin credentials) via an unauthenticated form-based file read, then uses those credentials to authenticate and achieve remote code execution by creating and running a workflow containing an Execute Command node.

Backdoor review

No backdoor observed in reviewed code

The PoC demonstrates the CVE-2026-21858 vulnerability by extracting n8n configuration and database files, then using recovered credentials to execute arbitrary commands via the n8n REST API. All observed behavior is consistent with a legitimate proof-of-concept exploit for the stated CVE. No concealed payload, persistence mechanism, credential exfiltration to an external party, or unrelated backdoor functionality was found.

ClassificationExploit
Model confidence100%
AuthenticationNot required
LanguagesPythonDockerfileBatchfile
Target softwaren8n
Attack typesRemote Code ExecutionInformation DisclosureAuthentication Bypass
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact contains a complete, functional exploit script (poc.py) that actively exercises the vulnerability to achieve remote code execution, not merely detect or report it. The README explicitly describes it as a 'PoC script' and 'exploit script' that provides an interactive shell.

README.md:3README.md:13README.md:50-53poc.py:127-170

Requirements

  • A vulnerable n8n instance (version 1.120.4) with a Form Trigger workflow activated and its URL known.README.md:3README.md:29-34
  • Python 3.x with dependencies (requests, PyJWT) installed on the attacker's machine.README.md:7README.md:39-41

Observed behavior

  • Reads arbitrary files from the n8n server by sending a crafted POST request to the Form Trigger URL with a 'files' payload containing a target filepath.poc.py:34-66
  • Extracts the encryption key from /home/n8n/.n8n/config and derives the FINAL_SECRET_KEY.poc.py:75-80
  • Extracts admin credentials (email, bcrypt hash, UUID) from /home/n8n/.n8n/database.sqlite.poc.py:82-98
  • Generates a forged JWT authentication token using the extracted secret and admin credentials, then sets session headers and cookies.poc.py:112-124
  • Creates a new n8n workflow containing an 'Execute Command' node with an attacker-supplied command, runs it, and retrieves the command output, achieving remote code execution.poc.py:127-170
  • Provides an interactive shell prompt ('n8n-shell>') for repeated command execution.poc.py:178-183
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Credential Extraction
encryptionKey from /home/n8n/.n8n/config and admin credentials from /home/n8n/.n8n/database.sqliteThe PoC reads sensitive n8n configuration files to derive a JWT secret and admin credentials, which are then used to authenticate to the n8n API for command execution. This is the core of the CVE-2026-21858 exploit.poc.py:75-110
Command Execution
Arbitrary command execution via n8n REST API using stolen admin sessionAfter extracting credentials, the script creates a new workflow containing an Execute Command node and runs it, retrieving the output. This demonstrates the RCE impact of the vulnerability.poc.py:127-170
Review boundaries

What the analysis did not establish

  • Two files (requirements.txt, workflow.txt) are reported in the inventory but their content is not included in the evidence packet.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository snapshot are present.
  • Two files (workflow.txt and requirements.txt) were omitted from the text evidence; their content is not reviewed. The workflow.txt file is referenced in the README for setting up the vulnerable environment, and requirements.txt lists Python dependencies. Neither is expected to contain executable backdoor logic, but their absence is a minor evidence gap.
  • The review is limited to static analysis of the provided text; no dynamic execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Docker lab environments

1
GitHub

Repository root

Created Vuln labCVE-2026-21858Dockerfile

1 Dockerfile

Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker-based environment running n8n version 1.120.4 with a Form Trigger workflow, intended as a proof-of-concept target for CVE-2026-21858. The environment includes a Python exploit script that extracts sensitive assets and achieves remote code execution on the n8n container.

README.md:1-3dockerfile:1-29

Lab assessment

Vulnerability lab

The README explicitly states it is a 'PoC environment for n8n 1.120.4' for CVE-2026-21858, and the included files (Dockerfile, exploit script, workflow) are structured to demonstrate a specific vulnerability with asset extraction and RCE.

README.md:1-3
Lab shapeDockerfile
ServicesUnknown
Compose manifests0
Dockerfiles1
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

n8n-vuln container

vulnerable target

Docker container built from the provided Dockerfile, running n8n@1.120.4 on Ubuntu 22.04 with Node.js. It exposes port 5678 internally, but the run script maps host port 9000 to container port 9000 via the N8N_PORT environment variable. The container runs as non-root user n8n.

dockerfile:1-29run.bat:1

poc.py

exploit script

Python script that performs two phases: (1) asset extraction by sending a crafted POST to the Form Trigger URL to read /home/n8n/.n8n/config and /home/n8n/.n8n/database.sqlite, deriving encryption key, admin ID, and admin hash, then forging a JWT session; (2) RCE by creating and executing a workflow containing an Execute Command node via the n8n REST API, and retrieving the command output.

poc.py:1-187

run.bat

launcher script

Windows batch script that runs the n8n-vuln container with port mapping 127.0.0.1:9000:9000, sets N8N_PORT=9000, N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS=true, and a placeholder encryption key.

run.bat:1

workflow.txt

vulnerable workflow definition

n8n workflow file containing a Form Trigger node, which is required for the exploit. The file is not included in the evidence packet, but is referenced in the README and file inventory.

README.md:10
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2026-21858

Supported by supplied evidence

The README explicitly associates the environment with CVE-2026-21858, and the PoC script demonstrates the described vulnerability: arbitrary file read leading to credential extraction and remote code execution on n8n 1.120.4.

README.md:1-3poc.py:1-187
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker must be installed to build and run the n8n container.README.md:6-7
  • Python 3.x and the requests, PyJWT packages must be installed on the attack host.README.md:7requirements.txt:1-2
  • The n8n container must be running with the Form Trigger workflow activated and the Form Trigger URL known.README.md:20-28

Evidence-described exercise path

  1. Build the Docker image using 'docker build -t n8n-vuln:1.120.4 .'README.md:14-16
  2. Run the container with 'run.bat' (Windows) or equivalent docker run command.README.md:18-20
  3. Configure n8n: open browser, login as admin, create workflow from workflow.txt, activate it, and copy the Form Trigger URL.README.md:22-28
  4. Install Python dependencies with 'pip3 install -r requirements.txt'.README.md:32-34
  5. Run the exploit script 'python3 poc.py' and provide the Form Trigger URL when prompted.README.md:36-40
  6. Observe asset extraction (SECRET_KEY, admin_id, admin_hash) and interact with the n8n-shell for RCE.README.md:42-58
Safety-review evidence

Behaviors behind the stored safety assessment

No harmful behavior observed

All visible behavior is directed at the lab's own n8n container target. The exploit script extracts credentials and executes commands within that container, which is the documented purpose of the vulnerability lab. There is no evidence of host escape, external connectivity, persistence, credential theft outside the lab, or destructive actions beyond the intended demonstration.

poc.py:1-187run.bat:1
Review boundaries

What the analysis did not establish

  • workflow.txt is referenced but not included in the evidence packet, so its exact content cannot be verified.
  • The run.bat script uses a placeholder encryption key 'CHANGE_ME_TO_A_LONG_RANDOM_STRING_32PLUS', which may affect exploit reliability but is not a safety concern.
  • The Dockerfile comments out a VOLUME instruction, but the run script does not mount any host directories, so no host file access is evident.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

Linked vulnerabilities

1