n8n content-type confusion shows how workflow RCE becomes identity risk

At a glance

What this is: Cyera’s analysis shows that a content-type confusion flaw in n8n can escalate from arbitrary file read to session forgery and remote code execution in locally deployed instances.

Why it matters: IAM, PAM, and NHI teams need to treat workflow automation platforms as identity-critical infrastructure because they concentrate secrets, authentication state, and downstream execution paths.

Context

n8n sits in the path of workflow automation, file handling, and authentication state, so a parsing flaw can quickly become an identity problem rather than a simple application bug. In this case, the control failure is not just request parsing but trust in a request field that also influences file-handling behaviour and stored session material.

The identity governance issue is that workflow platforms often become concentration points for credentials, tokens, and privileged connections across business systems. When a platform can read local files and forge session state, the boundary between application vulnerability and identity compromise disappears.

This pattern is increasingly typical in automation-heavy environments, where integration hubs inherit the privilege footprint of the systems they connect. The starting position here is typical for modern workflow platforms, which is why the blast radius is so large.

Key questions

Q: What breaks when file-upload workflows trust content-type parsing too much?

A: The file-handling path can be redirected away from a real upload and toward attacker-controlled values, which turns a benign parser decision into arbitrary file access. In practice, that means the application no longer knows whether a file object came from the upload pipeline or from crafted request data, so later logic can copy the wrong path and expose local files.

Q: Why does a local file read in a workflow engine become an identity problem?

A: Because workflow engines often store session material, database records, and config secrets locally in the same runtime that handles untrusted input. If an attacker can read those files, they may be able to reconstruct authentication state and mint a valid session, which converts disclosure into account takeover.

Q: How should security teams decide whether a workflow platform needs stronger controls than a normal application?

A: Use blast radius, not app category, as the test. If the platform centralises secrets, automation, and authentication state for multiple business systems, it should be governed like identity infrastructure with tighter segmentation, access review, and deployment controls than a standard internal web app.

Q: What is the difference between a file-handling bug and an identity compromise in an automation platform?

A: A file-handling bug exposes or moves data incorrectly, but an identity compromise starts when that data includes the material needed to forge sessions or impersonate privileged users. In automation platforms, those two outcomes often connect, which is why file access and session trust cannot be reviewed as separate risks.

Technical breakdown

How content-type confusion turns request parsing into file access

The core bug is a mismatch between how n8n decides which parser to run and what later workflow code assumes about the parsed output. If the request says multipart/form-data, the file upload parser populates req.body.files through Formidable. If the request is changed to another content type, the regular body parser runs instead, but later file-handling code can still trust req.body.files. That creates a controllable object in a place the application assumes only a real upload would reach. The weakness is not Formidable itself. It is the trust placed in parser-selected state after the request can be reclassified by an attacker.

Practical implication: enforce explicit content-type checks before any file-handling path consumes request-derived file objects.

Why local file read becomes session forgery

Once an attacker can steer filepath values, the same flow can be used to copy local files rather than uploaded content. In locally deployed n8n instances, that exposes sensitive state such as the database and config files that hold user records and signing material. With those pieces, an attacker can reconstruct the session cookie logic and forge a valid authentication token. This is the bridge from application-layer file handling to identity compromise. The security boundary is not just data exposure, but takeover of the session trust chain that protects privileged access inside the platform.

Practical implication: treat any local file read primitive in an automation platform as a potential authentication bypass candidate, not just a disclosure bug.

Why workflow platforms amplify identity risk

Workflow platforms are identity concentrators because they sit between users, APIs, files, and downstream services. They often hold cloud credentials, OAuth tokens, database connections, and administrative workflows in one place. That means a single parsing flaw can create a larger identity blast radius than the application surface suggests. In governance terms, the platform becomes a high-value non-human identity environment even when users interact through a friendly front end. The risk is structural: once one runtime can read trusted state and impersonate a session, every connected system inherits that compromise path.

Practical implication: classify workflow engines as high-impact identity infrastructure and apply stricter access, segmentation, and deployment review controls.

Threat narrative

Attacker objective: The attacker wants to move from a parsing flaw to privileged access inside the workflow platform and then pivot into connected enterprise systems.

1. Entry occurs through a crafted request that changes the expected content type on a file-upload workflow endpoint.
2. Credential or state access follows when the parser mismatch lets the attacker override req.body.files and read local files from the host.
3. Escalation occurs when locally stored database and config data provide the ingredients needed to forge the n8n-auth session cookie.
4. Impact is full instance takeover, which can extend to arbitrary workflow execution and downstream access to connected systems.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Workflow automation platforms are identity infrastructure, not just application middleware. Once a platform stores session material, local config, and downstream credentials in one execution plane, a parsing flaw becomes a governance issue. The practitioner mistake is treating automation tools as ordinary applications instead of high-impact non-human identity environments. Identity programmes should classify these platforms by blast radius, not by user interface simplicity.

Content-type trust is a hidden control boundary in file-handling workflows. The bug works because later logic assumes a parser decision made earlier in the request lifecycle is still trustworthy. That assumption is fragile in any platform that exposes file upload and form-handling paths to external input. The right mental model is that parser choice is part of the security decision, not a plumbing detail.

Session forgery is the point where application weakness becomes identity failure. Reading local files is only half the story; the real collapse happens when those files contain the material needed to mint a valid session. This is where IAM and application security converge. Organisations need to recognise that token material, config secrets, and database-backed identity state inside workflow systems create a single compromise path.

Identity blast radius is the named concept this case illustrates. One exposed workflow engine can concentrate authentication, file access, and downstream automation into a single compromise domain. That means a flaw in a single webhook can affect access to systems that were never directly vulnerable. The practitioner implication is to design governance around concentration risk, not around the nominal scope of one product.

n8n content-type confusion exposes a trust-chain failure, not just a CVE. The broken premise is that workflow input parsing, file movement, and authentication state can be safely reasoned about in separate layers. They cannot, because the same runtime controls all three. That is the structural lesson for identity governance teams reviewing automation platforms.

What this signals

Identity teams should treat workflow engines as trust concentrators. These systems frequently sit between users, credentials, files, and downstream services, so a single parsing flaw can undermine several control layers at once. The practical shift is to review them as part of the identity estate, not just the application stack.

Identity blast radius is the better design lens than vulnerability count. A low-level parser issue matters more when the platform can reach session state, local databases, and connected SaaS systems from one runtime. Programme owners should map where an automation hub can impersonate users, move data, or trigger privileged actions.

Workflow engines need governance that matches their privilege density. If the platform stores auth state, tokens, or config secrets locally, the organisation should assume that a file read path can become a privileged access problem. That changes hardening priorities from simple patching to containment, segmentation, and state isolation.

For practitioners

• Require explicit content-type validation Block file-handling code paths unless the request content type matches the expected upload format before any req.body.files access occurs.
• Isolate workflow runtime secrets Store session-signing material, database files, and configuration secrets outside the same runtime zone that handles untrusted uploads and form submissions.
• Constrain local file read exposure Review deployment patterns so a local file read in the workflow engine cannot reach session material, database content, or other identity state.
• Treat automation hubs as identity-critical Apply privileged access review, network segmentation, and deployment hardening to workflow engines that hold tokens, credentials, or authentication state.

Key takeaways

• The flaw shows how a file-upload parsing mistake can become a platform-wide trust failure when workflow code assumes request state is reliable.
• The article demonstrates escalation from content-type confusion to local file read, session forgery, and full instance takeover in locally deployed n8n.
• The control gap is not only patching, but separating upload handling, local secrets, and authentication state so one bug cannot reach privileged identity material.

Key terms

• Content-Type Confusion: Content-type confusion happens when an application chooses one parsing path but later trusts data as if a different path had been used. In security terms, that can let an attacker shape request fields, influence file handling, and turn input parsing into a control-flow problem.
• Session Forgery: The creation of a valid-looking authentication session without legitimate login credentials. In workflow platforms this often becomes possible when an attacker can read local secrets, database records, or signing keys, turning application exposure into identity takeover.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Workflow Automation: Workflow automation is the use of predefined rules, triggers, and actions to move work through a process without manual handoffs at every step. In identity programmes, it is useful for routing requests, but it does not replace entitlement decisions, revocation, or assurance that access state actually changed.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.