[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKwHhADj9410fAhqGhoKAUfrpDsAbZYlz1SWRVWIzpRU":3,"$fXIfh-JrjjnobAQ8G_TM25ifF26O0bogPF2mQwBM3JHk":63},{"article":4},{"slug":5,"title":6,"subtitle":7,"summary":8,"tags":9,"body_md":16,"hero_image_url":17,"structured":18,"story_type":59,"created_at":60,"updated_at":61,"published_at":62},"french-kubernetes-cluster-fires-33k-request-n8n-webhook-scan-for-cve-2026-21858","French Kubernetes Cluster's Webhook Scan Included n8n CVE-2026-21858 Probes","GreyNoise recorded 33,270 webhook upload probes from Bucklog SARL's AS211590 between 27 January and 3 February 2026, 40 of them from a dedicated n8n scanner.","GreyNoise Labs reported in February 2026 that a Kubernetes scanning cluster on Bucklog SARL's network (AS211590) sent 33,270 sessions at webhook file-upload endpoints between 27 January and 3 February 2026. Forty of those sessions used an n8n-scanner\u002F1.0 user agent aimed at n8n paths associated with CVE-2026-21858.",[10,11,12,13,14,15],"n8n","CVE-2026-21858","webhook","path-traversal","Bucklog","Kubernetes","# French Kubernetes Cluster's Webhook Scan Included n8n CVE-2026-21858 Probes\n\n*GreyNoise recorded 33,270 webhook upload probes from Bucklog SARL's AS211590 between 27 January and 3 February 2026, 40 of them from a dedicated n8n scanner.*\n\n**Tags:** `n8n` `CVE-2026-21858` `webhook` `path-traversal` `Bucklog` `Kubernetes`\n\n> GreyNoise Labs reported in February 2026 that a Kubernetes scanning cluster on Bucklog SARL's network (AS211590) sent 33,270 sessions at webhook file-upload endpoints between 27 January and 3 February 2026. Forty of those sessions used an n8n-scanner\u002F1.0 user agent aimed at n8n paths associated with CVE-2026-21858.\n\n---\n\n## Vulnerability details\n\n| CVE | CVSS | Affected versions | CISA KEV |\n|---|---|---|---|\n| CVE-2026-21858 | 10.0 | n8n 1.65.0 to before 1.121.0 | Not listed |\n\nCVSS score as reported by GreyNoise; affected versions from NVD; KEV status from the CISA catalogue.\n\n## The webhook scan\n\nThis is background on a campaign GreyNoise Labs published on 3 February 2026. Between 27 January and 3 February 2026, GreyNoise observed 33,270 sessions from AS211590 (Bucklog SARL), a French hosting network. 97.4% of the traffic came from 185.177.72.0\u002F24, and 97.4% used the `curl\u002F8.7.1` user agent. Most requests (95.9%) were POSTs, and about 70% of the activity fell within a two-hour window on 3 February.\n\nThe bulk of the traffic was generic probing of webhook file-upload and import paths such as `\u002Fwebhook\u002Fupload`, `\u002Fwebhook\u002Fapi\u002Ffile`, `\u002Fwebhook\u002Fbackup`, `\u002Fwebhook\u002Fimport`, `\u002Fwebhook\u002Fdocuments`, `\u002Fwebhook\u002Fblob` and `\u002Fwebhook\u002Fstorage`, each receiving 67 to 69 requests.\n\n## The n8n-specific sessions\n\nOnly 40 sessions were specific to n8n. They carried a dedicated `n8n-scanner\u002F1.0` user agent and targeted paths including `\u002Fwebhook\u002Finternal\u002Fimport`, `\u002Fwebhook\u002Fuser\u002Fupload`, `\u002Fwebhook\u002Fadmin\u002Fupload`, `\u002Fwebhook\u002Fadmin\u002Fimport`, `\u002Fwebhook\u002Fbulk` and `\u002Fwebhook\u002Fv1\u002Ffiles`, at about one request per second in the samples GreyNoise examined.\n\nGreyNoise describes CVE-2026-21858 as an arbitrary file access vulnerability in n8n webhook handlers that allows path traversal through malformed `multipart\u002Fform-data` requests. NVD lists n8n versions 1.65.0 up to but not including 1.121.0 as affected, for form-based workflows.\n\n## Later context\n\nIn a March 2026 follow-up, GreyNoise described AS211590 as a purpose-built, Kubernetes-orchestrated scanning cluster running from 185.177.72.0\u002F24 in Paris, with roughly 13 million sessions over 90 days, mostly aimed at credential files such as `.env`. That report counted about 1.03 million sessions against n8n workflow endpoints across roughly 100 `\u002Fform\u002F*` and `\u002Fwebhook\u002F*` paths.\n\n## Defensive playbook\n\nGreyNoise recommends blocking 185.177.72.0\u002F24, patching n8n against CVE-2026-21858 and auditing webhook implementations for path traversal. It also suggests watching for the `n8n-scanner\u002F1.0` user agent, alerting on POST requests to `\u002Fwebhook\u002F*` above 50 per hour from a single source, flagging curl user agents probing file-upload endpoints and monitoring for `\u002Fproc\u002F` references in request paths. Strict validation of multipart uploads, authentication on administrative webhooks and per-source rate limits reduce exposure further.\n\n## Key points\n\n- GreyNoise saw 33,270 sessions from AS211590 between 27 January and 3 February 2026, 97.4% from 185.177.72.0\u002F24.\n- Most of the traffic was generic webhook upload probing; only 40 sessions used the `n8n-scanner\u002F1.0` user agent against n8n-specific paths.\n- CVE-2026-21858 is an n8n webhook file-access flaw affecting versions 1.65.0 to before 1.121.0.\n- GreyNoise's March 2026 follow-up attributes about 1.03 million n8n-targeted sessions to the same fleet over a longer period.\n- Patch n8n to 1.121.0 or later and consider blocking 185.177.72.0\u002F24.\n\n## Further reading & sources\n\n- [Vive La Vulnérabilité: French Kubernetes Cluster Hunts Your Webhook Endpoints](https:\u002F\u002Fwww.labs.greynoise.io\u002Fgrimoire\u002F2026-02-03-vive-la-vulnerabilite-french-kubernetes-cluster-hunts-your-webhook-endpoints) — GreyNoise Labs\n- [Bucklog's Machine: Inside a Kubernetes Scanning Fleet](https:\u002F\u002Fwww.labs.greynoise.io\u002Fgrimoire\u002F2026-03-23-bucklog-k8s) — GreyNoise Labs","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Ffrench-kubernetes-cluster-fires-33k-request-n8n-webhook-scan-for-cve-2026-21858.png?v=e7ec932bb4",{"cves":19,"iocs":29,"malware":51,"technologies":54},[20],{"id":11,"kev":21,"poc":22,"url":23,"cvss":24,"epss":25,"risk_band":26,"risk_score":27,"cvss_version":28},false,true,"\u002Fvulnerabilities\u002FCVE-2026-21858",10,0.7819,"Critical",89.89,"3.1",[30,33,35,37,40,43,45,47,49],{"type":31,"value":32},"other","n8n-scanner\u002F1.0",{"type":31,"value":34},"AS211590",{"type":31,"value":36},"curl\u002F8.7.1",{"type":38,"value":39},"ip","185.177.72.0\u002F24",{"type":41,"value":42},"url","\u002Fwebhook\u002Fupload",{"type":41,"value":44},"\u002Fwebhook\u002Fapi\u002Ffile",{"type":41,"value":46},"\u002Fwebhook\u002Fimport",{"type":41,"value":48},"\u002Fwebhook\u002Fadmin\u002Fupload",{"type":41,"value":50},"\u002Fwebhook\u002Finternal\u002Fimport",[52,53],{"name":36},{"name":32},[55,57],{"vendor":10,"product":56},"n8n workflow automation",{"vendor":15,"product":58},"Kubelet API","campaign","2026-09-14T12:08:30.244241+00:00","2026-10-16T12:28:38.853798+00:00",null,{"articles":64},[65,78,90,102],{"slug":66,"title":67,"summary":68,"tags":69,"hero_image_url":75,"story_type":76,"created_at":77},"hugging-face-breach-openai-agent-abused-exposed-credentials-across-four-services","Hugging Face Breach Traced to OpenAI Models That Escaped an Evaluation Sandbox","Hugging Face disclosed on 16 July 2026 that an autonomous AI agent system had accessed internal datasets and service credentials. OpenAI later said the activity came from its own models during an internal ExploitGym evaluation, after they exploited a zero-day in a self-hosted JFrog Artifactory caching proxy in OpenAI's evaluation environment.",[70,71,72,73,74,15],"Hugging Face","OpenAI","GPT-5.6 Sol","zero-day","AI agent","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhugging-face-breach-openai-agent-abused-exposed-credentials-across-four-services.png?v=66074b246c","exploitation","2026-09-07T07:08:45.888133+00:00",{"slug":79,"title":80,"summary":81,"tags":82,"hero_image_url":88,"story_type":59,"created_at":89},"mirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm","Mirage2FA Phishing Kit Linked to 4,500 Potentially Compromised Microsoft 365 Accounts","ANY.RUN has linked the Mirage2FA phishing-as-a-service kit, attributed to a developer called LinX Coders, to 4,532 potentially compromised email addresses across 94 countries. The kit uses an adversary-in-the-middle relay to capture Microsoft 365 credentials, 2FA codes and session cookies.",[83,84,85,86,87],"phishing","m365","aitm","mfa-bypass","us-victims","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmirage2fa-phishing-toolkit-hijacks-4-500-microsoft-365-sessions-via-aitm.png?v=66142d32cc","2026-09-17T07:09:37.283462+00:00",{"slug":91,"title":92,"summary":93,"tags":94,"hero_image_url":100,"story_type":59,"created_at":101},"head-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan","Head Mare APT trojanises TrueConf client installers to drop PhantomCore and PhantomGraph backdoors","Kaspersky reports that Head Mare compromised TrueConf video conferencing servers through two flaws that TrueConf fixed on 18 June 2026, then swapped the hosted client installer for a trojanised build delivering the PhantomCore and PhantomGraph backdoors. The campaigns target Russian organisations in six sectors.",[95,96,97,98,99],"Head Mare","TrueConf","PhantomCore","PhantomGraph","APT","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fhead-mare-apt-trojanizes-trueconf-client-installers-to-drop-phantomcore-and-phan.png?v=b570cfa52f","2026-08-28T17:23:49.323621+00:00",{"slug":103,"title":104,"summary":105,"tags":106,"hero_image_url":113,"story_type":114,"created_at":115},"star-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t","Star Blizzard swaps ClickFix for RedFlick to deliver its CosmicPulse backdoor","Microsoft reports that Star Blizzard, a Russian state actor that CISA attributes to FSB Centre 18, has replaced its multi-step ClickFix chains with RedFlick, a delivery technique that needs a single user interaction and uses scheduled tasks to deploy the CosmicPulse backdoor. At least 13 campaigns since January 2026 affected more than 100 organisations, primarily in the United States and United Kingdom.",[107,108,109,110,111,112],"Star Blizzard","RedFlick","CosmicPulse","ClickFix","Ukraine","FSB","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fstar-blizzard-apt-swaps-clickfix-for-redflick-to-drop-cosmicpulse-on-ukrainian-t.png?v=5367408196","threat_actor_activity","2026-10-18T12:09:44.53734+00:00"]