CVE-2026-65014

Analyzed Analyzed - Analysis Complete

Unauthenticated Workflow Test Webhook Deletion in n8n

Publication date: 2026-07-22

Last updated on: 2026-07-27

Assigner: VulnCheck

Description

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-65014

EUVD

EUVD-2026-47630

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	From 2.27.0 (inc) to 2.27.4 (exc)
n8n	n8n	From 2.27.0 (inc) to 2.27.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-306	The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

Executive Summary

This vulnerability affects n8n versions before 2.28.0 and 2.27.4. It involves an unauthenticated endpoint that allows any network caller with knowledge of a workflow ID to cancel an active test webhook for that workflow. The issue occurs because the DELETE endpoint is registered before authentication middleware, enabling unauthorized access.

Detection Guidance

To detect this vulnerability, check if your n8n instance is running a vulnerable version (prior to 2.28.0 or 2.27.4). You can verify the version by running 'n8n --version' in the terminal where n8n is installed. Additionally, monitor network traffic for unauthorized DELETE requests to endpoints like /rest/test-webhook/:id.

Impact Analysis

The impact is limited to disrupting ongoing test sessions. Production webhooks, persistent workflow state, and stored data are not affected. An attacker could cancel active test webhooks if they know a workflow ID, but cannot access or modify production data.

Compliance Impact

This vulnerability does not directly impact compliance with GDPR or HIPAA as it only affects unauthenticated cancellation of test webhooks. Production webhooks, persistent workflow state, and stored data remain unaffected, which are the primary areas relevant to these regulations.

Mitigation Strategies

Immediately upgrade n8n to version 2.28.0 or later (or 2.27.4 for the 2.27.x branch). As a temporary measure, restrict network access to trusted users or place the n8n instance behind an authenticated reverse proxy or firewall to block unauthorized access to the vulnerable endpoint.

Hi! I’m here to help you understand CVE-2026-65014. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70