AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-65xw-2v52-jhxc: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter

mediumvulnerability

security

Source: GitHub Advisory DatabaseSeptember 10, 2026CVE-2026-86994

Summary

n8n, a workflow automation tool, had a security flaw where the `/rest/active-workflows` endpoint (an API endpoint that returns information) showed all active workflow IDs to any user on the instance, regardless of permissions. Additionally, events about workflow activation, deactivation, and publishing were broadcast to all connected clients with sensitive details like workflow IDs and error information, leaking data across different users.

Solution / Mitigation

The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should restrict n8n instance access to fully trusted users only and avoid provisioning 'global:member' accounts for untrusted users until the instance is patched, though these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.