n8n-security

Audit any self-hosted n8n instance for the misconfigurations that lead to takeover — the unauthenticated /rest/settings config+version leak, open owner-setup registration, a running version exposed to known critical CVEs, and a missing auth wall on the editor/REST API — and prove each one live with an anonymous probe. Other checklists tell you what might be wrong; this fetches the bytes and shows you what is.

⚡ Run it in one line, no API key, no install:

npx n8n-security --url https://your-n8n.example.com

🤝 Want it done for you? Fixed-scope audit — $99 / 24h: I verify each finding live and send a written report with the exact config fixes.

$ npx n8n-security --url https://n8n.example.com
2 critical, 2 high, 0 medium — 5 CONFIRMED via anonymous probe (version 1.100.0)
  CRITICAL  version 1.100.0   affected by CVE-2026-21858 'Ni8mare' (CVSS 10.0, unauth RCE)
  CRITICAL  /setup            owner account unclaimed — anyone can take the instance
  HIGH      /rest/settings    version + full config leaked with no auth
  HIGH      /api/v1/workflows public REST API answers without an API key

Why this exists

n8n is one of the fastest-growing self-hosted apps (5,834+ community nodes), and huge numbers of instances end up directly on the internet — Censys counts 26,512 exposed n8n hosts. The fatal default: the editor port is reachable with no auth wall, and /rest/settings answers anyone with the exact running version and full instance config.

That keyless oracle makes the rest trivial. Q1 2026 alone brought a cluster of critical CVEs, including CVE-2026-21858 'Ni8mare' (CVSS 10.0, unauthenticated RCE) and CVE-2026-21877 (CVSS 10.0) — an attacker reads your version off /rest/settings and picks the matching exploit.

n8n-security checks for these and confirms the real ones by issuing the exact anonymous request an attacker would — so you triage facts, not maybes.

What it checks

Check	Severity	How it's confirmed
/rest/settings config + version leak	high	anonymous GET /rest/settings returns 200 with versionCli + config
Running version vs known critical CVEs	critical	disclosed version compared to fixed releases (CVE-2026-21858, CVE-2026-21877)
Open owner-setup registration	critical	userManagement.showSetupOnFirstLoad === true → owner unclaimed
No auth on editor / REST API	critical	REST API answers anonymously and user-management is off
Public REST API without a key	high	GET /api/v1/workflows returns data with no X-N8N-API-KEY
CORS reflects arbitrary Origin	high	sends a foreign Origin, sees it echoed in Access-Control-Allow-Origin

Usage

# Probe a live instance
npx n8n-security --url https://n8n.example.com

# Write a shareable HTML report
npx n8n-security --url https://n8n.example.com --html report.html

# Static only (no requests sent)
npx n8n-security --url https://n8n.example.com --no-probe

Output is JSON on stdout (pipe it into CI) and a one-line summary on stderr. Exit is non-zero only on usage errors — gate your pipeline on the JSON summary.

Install (optional)

npm i -g n8n-security
n8n-security --url https://n8n.example.com

Zero dependencies. Your data and credentials never leave your machine — every request goes straight from the tool to your n8n instance.

Sister tools

Same active-probe philosophy for the rest of the backend stack, all MIT:

supabase-security · pocketbase-security · firebase-security · appwrite-security · nhost-security · strapi-security · directus-security · convex-security

License

MIT © Renzo Madueno

---

📚 Part of Awesome Backend Security Auditors — the full collection of keyless active-probe auditors.