n8n Type Confusion RCE Attempt

Tim Peck@timpeck

•updated Feb 9, 2026•2•0•35

Detects HTTP POST requests to n8n webhook endpoints containing patterns associated with CVE-2026-25049, a type confusion vulnerability leading to Remote Code Execution. The detection looks for specific JavaScript destructuring or property access patterns used to bypass sanitization.