CVE-2026-86079

Undergoing Analysis Undergoing Analysis - In Progress

Path Traversal in n8n Workflow Automation Platform

Publication date: 2026-09-08

Last updated on: 2026-09-11

Assigner: GitHub, Inc.

Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-11

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86079

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	From 2.38.0 (inc) to 2.38.2 (exc)
n8n	n8n	to 1.123.76 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.37.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

The vulnerability in n8n versions before 1.123.76, 2.37.7, and 2.38.2 involves improper handling of index and document identifiers in the Elasticsearch and ElasticSecurity nodes. These identifiers were directly interpolated into REST request paths without proper encoding, allowing path separators or dot segments to access unintended indices or cluster administration endpoints under stored credentials.

Impact Analysis

An attacker with access to workflow configuration could manipulate identifiers to read, modify, or delete data in unintended indices, or perform administrative actions on the Elasticsearch cluster. This could lead to unauthorized data exposure, data loss, or disruption of services relying on the cluster.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of sensitive data, violating confidentiality requirements in GDPR and HIPAA. Organizations using affected versions may face compliance violations, potential fines, and reputational damage due to data breaches.

Mitigation Strategies

Update n8n to versions 1.123.76, 2.37.7, or 2.38.2 or later to address the path traversal issue in Elasticsearch nodes.

Hi! I’m here to help you understand CVE-2026-86079. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70