CVE-2026-86073

Undergoing Analysis Undergoing Analysis - In Progress

OAuth Token Misuse in n8n Workflow Automation

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could substitute a different workflow URL in the resource parameter and obtain a valid token for an unapproved workflow accessible to the consenting user. This issue is fixed in versions 2.37.7 and 2.38.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-10

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86073

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	to 2.37.7 (exc)
n8n	n8n	2.38.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability in n8n's OAuth token handling allowed refresh tokens to be used across different resources than originally authorized. When a user approved an OAuth client for one workflow, the refresh token could be used to access a different workflow the user could access, bypassing consent. The issue occurred because refresh tokens were not bound to their approved resource during token rotation.

Detection Guidance

To detect this vulnerability, check if your n8n instance is running a version prior to 2.37.7 or 2.38.1. Run commands like 'n8n version' or check your deployment logs for version details. Review OAuth client configurations for unrecognized or unauthorized clients in your n8n admin panel.

Impact Analysis

An attacker could register an OAuth client, trick a user into approving it for one resource, then use the refresh token to gain unauthorized access to another resource the user could access. This could lead to data exposure or unauthorized actions in workflows the user did not explicitly approve.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating principles of least privilege and data protection. It may result in non-compliance with GDPR's data protection requirements or HIPAA's access controls, potentially leading to legal and regulatory penalties.

Mitigation Strategies

Upgrade n8n to versions 2.37.7 or 2.38.1 or later immediately. Audit and revoke any unrecognized OAuth clients in your n8n admin panel. Require users to re-authorize OAuth clients after upgrading. Restrict access to trusted users and deactivate workflows that are not essential.

Hi! I’m here to help you understand CVE-2026-86073. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70