N8n Io: 17 Vulnerabilities Disclosed Together Impacting Workflow Automation Platform
Key findings • 17 CVEs disclosed together for N8n on September 8, 2026, spanning multiple components. • High severity vulnerabilities include expression engine flaws, sanitizer bypass, and in…
Key findings
- 17 CVEs disclosed together for N8n on September 8, 2026, spanning multiple components.
- High severity vulnerabilities include expression engine flaws, sanitizer bypass, and insecure OpenAI node handling.
- Access control and credential management issues affect workflow execution and data security.
- Patches are available in N8n versions 1.123.76, 2.37.7, and 2.38.2.
- Users are urged to update promptly to mitigate risks.
On September 8, 2026, a batch of 17 vulnerabilities was disclosed for N8n, the open-source workflow automation platform. These vulnerabilities, disclosed within a 5-hour window, span various components and impact different functionalities, with several rated as High severity. The disclosures highlight potential risks in workflow execution, credential management, and data handling within the N8n ecosystem.
Several vulnerabilities relate to improper access control and workflow execution. CVE-2026-86996 indicates that workflow restrictions were not enforced when workflows were attached to an Agent as a tool, allowing restricted workflows to be invoked. CVE-2026-86085 points to issues with role management endpoints, where callers could potentially manage projects they did not have listing permissions for. Additionally, CVE-2026-86994 reveals that the /rest/active-workflows endpoint exposed all active workflow IDs to any member, regardless of sharing settings, and broadcasted activation events to unauthorized clients.
Credential and sensitive data handling are also affected. CVE-2026-86993 describes a flaw where a Log Streaming event destination could reference and decrypt any named credential ID without an ownership check, posing a risk to users with custom global roles. CVE-2026-86075 highlights an issue with the OAuth Dynamic Client Registration endpoint, which accepted arbitrarily large client_name and grant_types values, potentially exhausting resources. CVE-2026-86078 details a prototype pollution vulnerability in the Instance AI workflow summary, where specially crafted workflows could lead to unintended modifications of Object.prototype.
Security concerns extend to expression parsing and node-specific vulnerabilities. CVE-2026-86083, a High severity vulnerability, arises from the legacy expression engine's handling of JSON.stringify, allowing expressions to replace it and cause issues. CVE-2026-86076, also High severity, involves the expression compiler sanitizer, which could be rebound to reach the Function constructor, enabling code execution. CVE-2026-86082, another High severity issue, affects the OpenAI Chat Model node, where the model-search dropdown did not enforce domain restrictions, allowing arbitrary host redirection. CVE-2026-86081, a High severity Git node vulnerability, involved a catastrophic backtracking regex match against attacker-controlled destination paths during clone operations.
Other vulnerabilities include issues with OIDC authentication (CVE-2026-86084), GitHub Trigger webhook secrets (CVE-2026-86080), Elasticsearch and ElasticSecurity node path interpolations (CVE-2026-86079), Instance AI credential setup flows (CVE-2026-86074), and OAuth token endpoint refresh token binding (CVE-2026-86073). The affected versions for most of these vulnerabilities are prior to 1.123.76, 2.37.7, and 2.38.2, with specific exceptions noted for some CVEs.
The N8n team has addressed these vulnerabilities in releases 1.123.76, 2.37.7, and 2.38.2. Users are strongly advised to update to these patched versions to mitigate the risks associated with these diverse security flaws. This coordinated disclosure underscores the importance of timely patching and vigilance in maintaining the security posture of workflow automation platforms.
The batch of vulnerabilities disclosed on September 8, 2026, impacts N8n's core functionalities, including access control, credential management, and code execution. The coordinated release of these 17 CVEs highlights the need for users to promptly update their N8n instances to the latest patched versions.
The fixes for these vulnerabilities are available in N8n versions 1.123.76, 2.37.7, and 2.38.2. Users should consult the official N8n advisories for detailed information on each CVE and the specific patches applied. Staying updated is crucial for protecting against potential exploitation of these weaknesses.