VYPR
← All advisories
Medium severity4.3NVD Advisory· Published Sep 8, 2026· Updated Sep 10, 2026

CVE-2026-86994

CVE-2026-86994

Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details. The affected paths include packages/cli/src/services/active-workflows.service.ts and packages/cli/src/workflows/workflow-push-notifier.service.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
n8nnpm
< 1.123.761.123.76
n8nnpm
>= 2.38.0, < 2.38.22.38.2
n8nnpm
>= 2.0.0, < 2.37.72.37.7

Affected products

1
  • N8n Io/N8nllm-fuzzy
    Range: <1.123.76, <2.37.7, <2.38.2

Patches

Vulnerability mechanics

References

6

News mentions

1