| Component | n8n |
| Severity | medium (CVSS 6.3) |
| CVSS vector | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| Published (NVD) | 2026-10-14 |
| Affected versions | < 1.123.83 < 2.41.4 >= 2.42.0, < 2.42.1 read from the advisory text, followed where the structured sources say otherwise |
| Fixed in | 2.41.4, 2.42.1 |
| Weakness | CWE-288 |
| CISA KEV | not listed |
NVD description
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.
What to do
- Upgrade n8n to the fixed release of the branch you run:
2.41.4or2.42.1, or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-110852
- https://github.com/n8n-io/n8n/security/advisories/GHSA-4c7j-qff5-r9cx
- https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-unauthenticated-workflow-execution-via-dynamic-path-webhook-resolution