{"data":{"id":"f84d51cd-d616-48f0-861f-b0e28ca67274","title":"GHSA-33q9-f52j-gc75: n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook","summary":"GHSA-33q9-f52j-gc75 is an n8n issue in which the DELETE /${restEndpoint}/test-webhook/:id route is registered before authentication middleware is applied. Any unauthenticated network caller who knows a workflow ID can cancel that workflow's active test webhook registration. Impact is limited to disrupting in-progress test sessions, while production webhooks, persistent workflow state and stored data are not affected.","solution":"Users should upgrade to the patched version once available. If upgrading is not immediately possible, restrict network access to the n8n instance to fully trusted users only, or place it behind a reverse proxy or firewall that requires authentication before reaching the REST API. The source states these workarounds do not fully remediate the risk and should only be used as short-term measures.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-33q9-f52j-gc75","publishedAt":"2026-07-22T22:36:10.000Z","cveId":"CVE-2026-65014","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["n8n@< 2.27.4 (fixed: 2.27.4)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0059,"epssCheckedAt":"2026-11-13T00:12:56.154Z","kevDateAdded":null,"advisoryAliases":["GHSA-33q9-f52j-gc75"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-22T22:36:10.000Z","fixReleasedAt":"2026-06-24T10:42:03.277Z","daysToFix":-28,"fixCheckedAt":"2026-10-29T21:32:43.567Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.7,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"2.27.4","matchedVersion":"2.27.4","fixReleasedAt":"2026-06-24T10:42:03.277Z","daysToFix":-28,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:43.418Z"}]}}