Skip to content
AI Sec Watch
MediumVulnerability

GHSA-33q9-f52j-gc75: n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-65014GHSA-33q9-f52j-gc75
Published
Record updated
View JSON
Affected
  • n8n < 2.27.4
Fixed in
2.27.4
  • released June 24, 2026, 28 days before disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.6%

Summary

GHSA-33q9-f52j-gc75 is an n8n issue in which the DELETE /${restEndpoint}/test-webhook/:id route is registered before authentication middleware is applied. Any unauthenticated network caller who knows a workflow ID can cancel that workflow's active test webhook registration. Impact is limited to disrupting in-progress test sessions, while production webhooks, persistent workflow state and stored data are not affected.

Mitigation

Users should upgrade to the patched version once available. If upgrading is not immediately possible, restrict network access to the n8n instance to fully trusted users only, or place it behind a reverse proxy or firewall that requires authentication before reaching the REST API. The source states these workarounds do not fully remediate the risk and should only be used as short-term measures.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • n8nnpmLLM dependency since 2026-02-10

Related items