CVE-2026-86994

Analyzed Analyzed - Analysis Complete

Information Disclosure in n8n Workflow Automation

Publication date: 2026-09-08

Last updated on: 2026-09-10

Assigner: GitHub, Inc.

Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details. The affected paths include packages/cli/src/services/active-workflows.service.ts and packages/cli/src/workflows/workflow-push-notifier.service.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-10

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-86994

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	From 2.38.0 (inc) to 2.38.2 (exc)
n8n	n8n	to 1.123.76 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.37.7 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This vulnerability in n8n allows any authenticated user to view active workflow IDs on an instance, even if they don't have permission to access those workflows. The issue occurs because the /rest/active-workflows endpoint exposes workflow details to all members, and push events broadcast sensitive information like workflow IDs and activation errors to unauthorized users.

Detection Guidance

Check n8n instance versions to see if they are below 1.123.76, 2.37.7, or 2.38.2. Inspect network traffic for unauthorized access to /rest/active-workflows endpoint or unusual broadcast events related to workflow IDs and version details.

Impact Analysis

An attacker could exploit this to enumerate active workflows on your n8n instance, potentially revealing sensitive workflow configurations or business processes. This could lead to further attacks if workflows contain credentials or access tokens.

Compliance Impact

This vulnerability may violate compliance requirements by exposing sensitive workflow data to unauthorized users. GDPR could be impacted if personal data is processed in exposed workflows, while HIPAA may be violated if healthcare-related workflows are disclosed.

Mitigation Strategies

Upgrade n8n to versions 1.123.76, 2.37.7, or 2.38.2 or later immediately. Review and restrict access controls to prevent unauthorized access to workflow endpoints and events.

Hi! I’m here to help you understand CVE-2026-86994. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70