GHSA-65xw-2v52-jhxc: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter
- Identifiers
- CVE-2026-86994GHSA-65xw-2v52-jhxc
- Published
- Record updated
- Affected
- n8n >= 2.0.0, < 2.37.7, fixed in 2.37.7, released September 2, 2026, 8 days before disclosure
- n8n >= 2.38.0, < 2.38.2, fixed in 2.38.2, released September 2, 2026, 8 days before disclosure
- n8n < 1.123.76, fixed in 1.123.76, released September 2, 2026, 8 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
The endpoint `/rest/active-workflows` in n8n returned every active workflow ID on the instance to any member, regardless of sharing. Workflow activation, deactivation and publication push events were also broadcast to all connected clients, exposing workflow IDs, version IDs and activation-error detail across users. The patch scopes both the listing and the push events through the sharing service.
Mitigation
Upgrade to n8n 1.123.76, 2.37.7, 2.38.2 or later. If upgrading is not immediately possible, restrict instance access to fully trusted users only and avoid provisioning `global:member` accounts for untrusted users until the instance is patched. The source states these workarounds do not fully remediate the risk and are short-term measures only.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- n8nnpmDeclares an LLM dependency