CVE-2026-21858: A public workflow attaches a server-local file

A public form execution attaches a server-local file that the submitter never uploaded. Contain the exposed path and restore the affected workflow without weakening its security boundary.

Jamie Engineering lead · 02:13 a.m.

Team workspace / us-east. Investigate n8n-forms, restore service, and verify the result.