CVE-2026-59253: n8n auth bypass moves workflows

Q: Is CVE-2026-59253 actively exploited?

No confirmed active exploitation of CVE-2026-59253 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-59253?

Upgrade n8n to version 2.28.0 or later, where the authorization check on workflow-to-folder assignment during creation is enforced correctly. Until patched, restrict workflow-creation permissions to trusted users only and avoid shared multi-tenant instances where projects belong to different trust domains. Monitor for unexpected workflow relocations by periodically auditing folder/project assignments via the n8n API or database, and alert on workflow creation events that target folders outside the requesting user's assigned project. Review audit logs for anomalous cross-project folder references following any period the instance ran an affected version.

Q: What systems are affected by CVE-2026-59253?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration.

Q: What is the CVSS score for CVE-2026-59253?

CVE-2026-59253 has a CVSS v3.1 base score of 5.0 (MEDIUM). The EPSS exploitation probability is 0.17%.

CISO Take

n8n before 2.28.0 has an improper authorization flaw (CWE-639) where any authenticated user, even with low privileges, can craft a workflow-creation request that assigns the workflow to a folder in a different project, bypassing the project/folder isolation boundary. There's no confidentiality or availability impact and no public exploit, PoC, or Nuclei template exists, and EPSS data isn't available, but the practical risk is multi-tenant integrity: any org running n8n as a shared platform for multiple teams or clients to build AI agent workflows can have that project isolation silently violated by a low-privileged insider. With 123 other CVEs already tracked in this package and an OpenSSF Scorecard of 6.6/10, n8n's attack surface and patch cadence both warrant scrutiny for anyone using it as an AI orchestration backbone. Upgrade to n8n 2.28.0 or later immediately, and until patched, audit folder/project structures for unexpected workflow placements and restrict who can create workflows in shared or multi-tenant instances.

Sources: NVD GitHub Advisory

What is the risk?

Medium severity (CVSS 5.0) with network attack vector, low complexity, and no user interaction required, but privileges are required and impact is confined to integrity (workflow/folder structure corruption) with no confidentiality or availability loss. There is no evidence of active exploitation (not in CISA KEV, no SSVC decision, no EPSS score, no public exploit or scanner template), which lowers urgency for opportunistic mass exploitation but does not eliminate insider-threat or multi-tenant risk. The scope change (S:C) reflects that a low-privileged user in one project can affect resources belonging to a different project, which is the core concern for any organization using n8n as a shared, multi-tenant automation/agent platform.

How does the attack unfold?

Initial Access

Attacker authenticates as a low-privileged user with workflow-creation rights on a shared n8n instance.

Exploitation

Attacker submits a crafted workflow-creation request specifying a folder ID belonging to a different project, bypassing the missing authorization check.

Impact

The workflow is placed inside another project's folder structure, causing a logical integrity violation that corrupts project/folder isolation and can disrupt or confuse other teams' AI automation pipelines.

AML.T0081

Initial Access

Attacker authenticates as a low-privileged user with workflow-creation rights on a shared n8n instance.

Exploitation

Attacker submits a crafted workflow-creation request specifying a folder ID belonging to a different project, bypassing the missing authorization check.

Impact

The workflow is placed inside another project's folder structure, causing a logical integrity violation that corrupts project/folder isolation and can disrupt or confuse other teams' AI automation pipelines.

AML.T0081

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 2.28.0	`2.28.0`
201.9K OpenSSF 6.7 Pushed today 51% patched ~6d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

5.0 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Changed

C None

I Low

A None

What should I do?

1 step

Upgrade n8n to version 2.28.0 or later, where the authorization check on workflow-to-folder assignment during creation is enforced correctly. Until patched, restrict workflow-creation permissions to trusted users only and avoid shared multi-tenant instances where projects belong to different trust domains. Monitor for unexpected workflow relocations by periodically auditing folder/project assignments via the n8n API or database, and alert on workflow creation events that target folders outside the requesting user's assigned project. Review audit logs for anomalous cross-project folder references following any period the instance ran an affected version.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Agent AML.T0081 - Modify AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.8 - Security of AI system infrastructure and access control

NIST AI RMF

GOVERN 1.5 - Access control policies for AI system components

Frequently Asked Questions

What is CVE-2026-59253?

n8n before 2.28.0 has an improper authorization flaw (CWE-639) where any authenticated user, even with low privileges, can craft a workflow-creation request that assigns the workflow to a folder in a different project, bypassing the project/folder isolation boundary. There's no confidentiality or availability impact and no public exploit, PoC, or Nuclei template exists, and EPSS data isn't available, but the practical risk is multi-tenant integrity: any org running n8n as a shared platform for multiple teams or clients to build AI agent workflows can have that project isolation silently violated by a low-privileged insider. With 123 other CVEs already tracked in this package and an OpenSSF Scorecard of 6.6/10, n8n's attack surface and patch cadence both warrant scrutiny for anyone using it as an AI orchestration backbone. Upgrade to n8n 2.28.0 or later immediately, and until patched, audit folder/project structures for unexpected workflow placements and restrict who can create workflows in shared or multi-tenant instances.

Is CVE-2026-59253 actively exploited?

No confirmed active exploitation of CVE-2026-59253 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59253?

Upgrade n8n to version 2.28.0 or later, where the authorization check on workflow-to-folder assignment during creation is enforced correctly. Until patched, restrict workflow-creation permissions to trusted users only and avoid shared multi-tenant instances where projects belong to different trust domains. Monitor for unexpected workflow relocations by periodically auditing folder/project assignments via the n8n API or database, and alert on workflow creation events that target folders outside the requesting user's assigned project. Review audit logs for anomalous cross-project folder references following any period the instance ran an affected version.

What systems are affected by CVE-2026-59253?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration.

What is the CVSS score for CVE-2026-59253?

CVE-2026-59253 has a CVSS v3.1 base score of 5.0 (MEDIUM). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration

MITRE ATLAS Techniques

AML.T0081 Modify AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.8

NIST AI RMF: GOVERN 1.5

What are the technical details?

Original Advisory

n8n before 2.28.0 contains an improper authorization vulnerability allowing authenticated users to assign workflows to folders in other projects. Attackers can bypass project and folder authorization boundaries by supplying crafted request payloads during workflow creation, causing logical integrity violations in target project folder structures.

Exploitation Scenario

An attacker with a low-privileged, authenticated account on a shared n8n instance (e.g., a contractor or junior team member scoped to one project) crafts a workflow-creation API request with a manipulated folder/project identifier pointing to a folder belonging to a different, higher-trust project. Because the server fails to validate that the target folder actually belongs to the requester's authorized project, the workflow is created inside the victim project's folder structure, corrupting its organization and potentially confusing operators who rely on folder structure to scope automation or agent permissions. Repeated abuse could be used to pollute or disrupt another team's AI automation pipelines, or as a reconnaissance step to map out project/folder naming conventions across the instance.

Weaknesses (CWE)

CWE-639 Authorization Bypass Through User-Controlled Key Primary CWE-639 Authorization Bypass Through User-Controlled Key CWE-639 Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.