CVE-2026-110852: n8n: auth bypass runs workflows across projects

UNKNOWN

Published October 14, 2026

CISO Take

n8n's dynamic-path webhook resolution matched requests on the path alone and ignored the server-generated identifier that was meant to make webhook URLs unguessable. An unauthenticated attacker can omit that identifier on webhook, form, or MCP routes and trigger workflows in unrelated projects, which run under those projects' own credentials. That makes this a cross-tenant execution flaw in a platform that often holds API keys for LLMs, databases, and SaaS tools. No CVSS, EPSS, KEV, or public exploit data exists yet, so urgency rests on the nature of the flaw: it needs no authentication, and exposed n8n instances are easy to find. Upgrade to 1.123.83, 2.41.4, or 2.42.1 or later, and review execution logs for webhook calls that lack the expected identifier segment.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Likely high. The flaw needs no authentication and no user interaction, and the issue is an authentication bypass (CWE-288) on internet-facing routes. Executed workflows run with the credentials of the victim project, so the effect depends on what each workflow can do. The score is unconfirmed because no CVSS, EPSS, KEV, or SSVC data is available, and there is no known public exploit or Nuclei template. Instances that expose webhook, form, or MCP routes to the internet, and multi-project or multi-tenant deployments, face the greatest exposure.

How does the attack unfold?

Discovery

Attacker finds internet-facing n8n instances with exposed webhook, form, or MCP routes.

AML.T0006

Authentication Bypass

Attacker sends requests that omit the server-generated identifier so the path alone resolves to another project's workflow.

AML.T0049

Workflow Execution

The targeted workflow or agent tool runs under the victim project's stored credentials with attacker-supplied input.

AML.T0053

Impact

Data is exposed, connected systems are modified, or LLM and API costs are incurred under the victim project's identity.

AML.T0048

Discovery

Attacker finds internet-facing n8n instances with exposed webhook, form, or MCP routes.

AML.T0006

Authentication Bypass

Attacker sends requests that omit the server-generated identifier so the path alone resolves to another project's workflow.

AML.T0049

Workflow Execution

The targeted workflow or agent tool runs under the victim project's stored credentials with attacker-supplied input.

AML.T0053

Impact

Data is exposed, connected systems are modified, or LLM and API costs are incurred under the victim project's identity.

AML.T0048

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 29% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade n8n to 1.123.83 or later on the 1.x line, 2.41.4 or later on 2.x, or 2.42.1 or later on 2.42.x. 2) Until patched, restrict access to webhook, form, and MCP routes with a reverse proxy, WAF, IP allowlist, or VPN, and block public access where it is not needed. 3) Audit execution history for webhook, form, and MCP calls from unexpected sources, especially requests missing the identifier path segment, and for workflows that ran at unusual times. 4) Rotate credentials held in workflows that could have been triggered unexpectedly if suspicious executions are found. 5) Add authentication (header auth, basic auth, or JWT) to webhook nodes as defense in depth, and apply least privilege to the credentials workflows use.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassCode ExecutionAgentFrameworkAPIAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks are developed and documented

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-110852?

Is CVE-2026-110852 actively exploited?

No confirmed active exploitation of CVE-2026-110852 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110852?

1) Upgrade n8n to 1.123.83 or later on the 1.x line, 2.41.4 or later on 2.x, or 2.42.1 or later on 2.42.x. 2) Until patched, restrict access to webhook, form, and MCP routes with a reverse proxy, WAF, IP allowlist, or VPN, and block public access where it is not needed. 3) Audit execution history for webhook, form, and MCP calls from unexpected sources, especially requests missing the identifier path segment, and for workflows that ran at unusual times. 4) Rotate credentials held in workflows that could have been triggered unexpectedly if suspicious executions are found. 5) Add authentication (header auth, basic auth, or JWT) to webhook nodes as defense in depth, and apply least privilege to the credentials workflows use.

What systems are affected by CVE-2026-110852?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation, MCP servers, multi-tenant AI orchestration, LLM-integrated pipelines.

What is the CVSS score for CVE-2026-110852?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automationMCP serversmulti-tenant AI orchestrationLLM-integrated pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.

Exploitation Scenario

An attacker finds an internet-facing n8n instance that hosts several projects. They send requests to the base webhook path and leave out the server-generated identifier, so the path alone resolves to a workflow in another project, such as an AI agent that queries an internal knowledge base and posts to Slack. The workflow runs under that project's stored credentials and processes the attacker's input. The attacker can pull data out through the response, trigger agent tool calls, or cause side effects in connected systems. They can repeat this across projects by guessing common path names.

Weaknesses (CWE)

CWE-288Authentication Bypass Using an Alternate Path or ChannelPrimary CWE-288Authentication Bypass Using an Alternate Path or Channel

CWE-288 — Authentication Bypass Using an Alternate Path or Channel: The product requires authentication, but the product has an alternate path or channel that does not require authentication.

[Architecture and Design] Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE corpus.