n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.
CVE-2026-110852
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-110852
n8n
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"vendor": "n8n-io",
"product": "n8n",
"versions": [
{
"status": "affected",
"version": "0",
"lessThan": "1.123.83",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.0.0",
"lessThan": "2.41.4",
"versionType": "semver"
},
{
"status": "affected",
"version": "2.42.0",
"lessThan": "2.42.1",
"versionType": "semver"
}
],
"packageURL": "pkg:npm/n8n",
"defaultStatus": "unaffected"
}
]- Related CVEs
- CVE-2026-110852
Source reference:
/cveMetadata/cveId
Publisher severity
medium
Source reference: /containers/cna/metrics
- Event
- #28726 · Revision 1
- Added to Heist Feed
- Publisher date