AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-f2cp-m7mv-8jpv: n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

mediumvulnerability

security

Source: GitHub Advisory DatabaseSeptember 10, 2026CVE-2026-86079

Summary

The Elasticsearch and ElasticSecurity nodes in n8n (a workflow automation tool) had a path injection vulnerability where user-provided identifiers weren't properly encoded in REST API requests, allowing an attacker to access unintended indexes or administrative endpoints using stored Elasticsearch credentials. An attacker could manipulate identifier values containing path separators to redirect operations meant for one document to a different index or system endpoint.

Solution / Mitigation

The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, temporary workarounds include: restricting n8n instance access to fully trusted users only, disabling the affected nodes by adding `n8n-nodes-base.elasticsearch` and `n8n-nodes-base.elasticSecurity` to the `NODES_EXCLUDE` environment variable if not required, and auditing existing workflows to ensure index and document identifier fields do not accept externally-controlled input. The source notes these workarounds do not fully remediate the risk and should only be used as short-term measures.