Post

Hacker Sidekick has once again autonomously exploited a critical vulnerability in popular software, this time a Remote Code Execution vulnerability in n8n, the workflow automation platform that thousands of companies run in production. One prompt. Video and blog: hackersidekick.com/hacker-sidek...

hackersidekick.comHacker Sidekick Achieves Remote Code Execution on n8n with CVE-2026-21858One prompt, no guidance: Hacker Sidekick built a PoC for CVE-2026-21858, mapped file read to RCE on n8n, validated vulnerable vs patched Docker targets, and documented the full chain.

Hacker Sidekick - The Agentic Workbench for Cybersecurity

@hackersidekick.com

14 May

The attack: send application/json to a Form Trigger endpoint instead of multipart/form-data. The handler writes the attacker-controlled files object directly into the request body. Point filepath at /etc/passwd. The workflow execution data returns the contents base64-encoded.

Hacker Sidekick - The Agentic Workbench for Cybersecurity

@hackersidekick.com

What makes this demo different from most AI showcases: it shows the failures. The wrong API endpoints. Reading the n8n source code inside the Docker container to figure out why. Multiple iterations before the exploit works. The AI handles the tedious parts so you can focus on the important parts.

14/5/26, 3:24 pm0 reposts0 likes

Hacker Sidekick - The Agentic Workbench for Cybersecurity

@hackersidekick.com

14 May

Give it a try yourself, download for free at: hackersidekick.com #cybersecurity #infosec #hackersidekick #pentesting #exploitdev #n8n #CVE202621858

hackersidekick.comHacker Sidekick - desktop integrated hacking environmentIntroducing the new Hacker Sidekick: sovereign AI, local execution, and your toolchain in a desktop integrated hacking environment.