Campaign14 Sept 2026·2 sources
French Kubernetes Cluster's Webhook Scan Included n8n CVE-2026-21858 Probes
GreyNoise Labs reported in February 2026 that a Kubernetes scanning cluster on Bucklog SARL's network (AS211590) sent 33,270 sessions at webhook file-upload endpoints between 27 January and 3 February 2026. Forty of those sessions used an n8n-scanner/1.0 user agent aimed at n8n paths associated with CVE-2026-21858.
n8nCVE-2026-21858webhook+3
