CVE-2026-110852CWE-288

CVE-2026-110852

published October 15, 2026

CVSS
6.3
EPSS
0%
Percentile
28.0
In the wild
Unconfirmed
What it is

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.

The record
Technical detail
CVSS
6.3 · NONE
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
EPSS
0.00355 · 28.0th percentile
Weakness
CWE-288 · Authentication Bypass Using an Alternate Path or Channel
Published
2026-10-15T03:17Z
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-4c7j-qff5-r9cx · [email protected]https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-unauthenticated-workflow-execution-via-dynamic-path-webhook-resolution · [email protected]
EPSS history
Timeline
  • 16 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 14 OCT 22:52Z
    n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
    cvelistv5
  • 14 OCT 22:52Z
    n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
    cvelistv5