All news
campaign

EdgeProtect

French Kubernetes Cluster's Webhook Scan Included n8n CVE-2026-21858 Probes

GreyNoise recorded 33,270 webhook upload probes from Bucklog SARL's AS211590 between 27 January and 3 February 2026, 40 of them from a dedicated n8n scanner.

14 September 2026
n8nCVE-2026-21858webhookpath-traversalBucklogKubernetes
French Kubernetes Cluster's Webhook Scan Included n8n CVE-2026-21858 Probes

At a glance

1 CVE

Vulnerabilities

CVECVSSEPSSKEVPoCPRS risk
CVE-2026-218581078.2%-Available90 · Critical

Technology affected

n8n · n8n workflow automationKubernetes · Kubelet API

Malware & tooling

curl/8.7.1n8n-scanner/1.0

Indicators of compromise

  • othern8n-scanner/1.0
  • otherAS211590
  • othercurl/8.7.1
  • ip185.177.72.0/24
  • url/webhook/upload
  • url/webhook/api/file
  • url/webhook/import
  • url/webhook/admin/upload
  • url/webhook/internal/import

Vulnerability details

CVE CVSS Affected versions CISA KEV
CVE-2026-21858 10.0 n8n 1.65.0 to before 1.121.0 Not listed

CVSS score as reported by GreyNoise; affected versions from NVD; KEV status from the CISA catalogue.

The webhook scan

This is background on a campaign GreyNoise Labs published on 3 February 2026. Between 27 January and 3 February 2026, GreyNoise observed 33,270 sessions from AS211590 (Bucklog SARL), a French hosting network. 97.4% of the traffic came from 185.177.72.0/24, and 97.4% used the curl/8.7.1 user agent. Most requests (95.9%) were POSTs, and about 70% of the activity fell within a two-hour window on 3 February.

The bulk of the traffic was generic probing of webhook file-upload and import paths such as /webhook/upload, /webhook/api/file, /webhook/backup, /webhook/import, /webhook/documents, /webhook/blob and /webhook/storage, each receiving 67 to 69 requests.

The n8n-specific sessions

Only 40 sessions were specific to n8n. They carried a dedicated n8n-scanner/1.0 user agent and targeted paths including /webhook/internal/import, /webhook/user/upload, /webhook/admin/upload, /webhook/admin/import, /webhook/bulk and /webhook/v1/files, at about one request per second in the samples GreyNoise examined.

GreyNoise describes CVE-2026-21858 as an arbitrary file access vulnerability in n8n webhook handlers that allows path traversal through malformed multipart/form-data requests. NVD lists n8n versions 1.65.0 up to but not including 1.121.0 as affected, for form-based workflows.

Later context

In a March 2026 follow-up, GreyNoise described AS211590 as a purpose-built, Kubernetes-orchestrated scanning cluster running from 185.177.72.0/24 in Paris, with roughly 13 million sessions over 90 days, mostly aimed at credential files such as .env. That report counted about 1.03 million sessions against n8n workflow endpoints across roughly 100 /form/* and /webhook/* paths.

Defensive playbook

GreyNoise recommends blocking 185.177.72.0/24, patching n8n against CVE-2026-21858 and auditing webhook implementations for path traversal. It also suggests watching for the n8n-scanner/1.0 user agent, alerting on POST requests to /webhook/* above 50 per hour from a single source, flagging curl user agents probing file-upload endpoints and monitoring for /proc/ references in request paths. Strict validation of multipart uploads, authentication on administrative webhooks and per-source rate limits reduce exposure further.

Key points

  • GreyNoise saw 33,270 sessions from AS211590 between 27 January and 3 February 2026, 97.4% from 185.177.72.0/24.
  • Most of the traffic was generic webhook upload probing; only 40 sessions used the n8n-scanner/1.0 user agent against n8n-specific paths.
  • CVE-2026-21858 is an n8n webhook file-access flaw affecting versions 1.65.0 to before 1.121.0.
  • GreyNoise's March 2026 follow-up attributes about 1.03 million n8n-targeted sessions to the same fleet over a longer period.
  • Patch n8n to 1.121.0 or later and consider blocking 185.177.72.0/24.

Further reading & sources