N8n Content-Type Confusion Exploit Attempt (CVE-2026-21858)

Tim Peck@timpeck

•updated Jan 7, 2026•12•4•165

Detects HTTP POST requests to n8n '/form/*' endpoints where the Content-Type header is 'application/json'. This indicates an attempt to exploit the Content-Type confusion vulnerability (CVE-2026-21858) to achieve arbitrary file read and subsequent remote code execution.