CVE-2026-65014: n8n unauth DELETE cancels test

Q: Is CVE-2026-65014 actively exploited?

No confirmed active exploitation of CVE-2026-65014 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-65014?

1) Upgrade n8n to 2.28.0, or to 2.27.4 if pinned to the 2.27.x branch — this is the vendor fix (GHSA-33q9-f52j-gc75). 2) Until upgraded, place n8n's REST endpoint behind a reverse proxy or firewall rule that blocks external/unauthenticated access to `/${restEndpoint}/test-webhook/*`, especially in multi-tenant or internet-facing deployments. 3) Avoid exposing test/dev n8n instances directly to the internet — use VPN or IP allowlisting for the builder UI and its API. 4) Detection: alert on unauthenticated DELETE requests to test-webhook endpoints in access logs/WAF, and on unexpected test-session cancellations reported by workflow developers.

Q: What systems are affected by CVE-2026-65014?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration, webhook-triggered pipelines.

Q: What is the CVSS score for CVE-2026-65014?

No CVSS score has been assigned yet.

CISO Take

n8n registers its DELETE test-webhook/:id route before the authentication middleware runs, so any network caller who knows or guesses a workflow ID can cancel that workflow's active test webhook without credentials. n8n is a widely deployed AI agent orchestration platform with 16 tracked downstream dependents, but the blast radius here is narrow: the flaw only cancels an in-progress test session, it does not touch production webhooks, stored workflow state, or data. There is no EPSS score, it is not in CISA KEV, and no public exploit code or Nuclei template exists, so opportunistic mass exploitation is unlikely — this reads as an annoyance/DoS bug rather than a breach vector. Upgrade to n8n 2.28.0 (or 2.27.4 on the 2.27.x branch) to restore proper middleware ordering; until patched, restrict network access to the /test-webhook/ path via a reverse proxy allowlist and monitor for unauthenticated DELETE calls to that endpoint as a low-priority detection rule.

Sources: NVD GitHub Advisory CISA KEV ATLAS OpenSSF

What is the risk?

Low overall risk. Exploitability is technically trivial — no authentication, no user interaction, only a workflow ID is required — but the impact ceiling is capped at disrupting a developer's active test webhook session (CWE-306, missing authentication for a critical function). No CVSS score has been assigned, EPSS/KEV/exploit-maturity signals are all absent, and the package's OpenSSF Scorecard of 6.6/10 reflects generally reasonable engineering hygiene despite this lapse. Treat as a routine patch-cycle item, not an incident-response trigger.

How does the attack unfold?

Discovery

Attacker identifies an internet-reachable n8n instance and obtains or enumerates a target workflow's ID.

AML.T0006

Exploitation

Attacker sends an unauthenticated DELETE request to /${restEndpoint}/test-webhook/:id, which n8n processes before its auth middleware runs.

AML.T0049

Impact

The workflow's active test webhook registration is cancelled, disrupting the developer's in-progress agent workflow testing session with no effect on production data or state.

AML.T0029

Discovery

Attacker identifies an internet-reachable n8n instance and obtains or enumerates a target workflow's ID.

AML.T0006

Exploitation

Attacker sends an unauthenticated DELETE request to /${restEndpoint}/test-webhook/:id, which n8n processes before its auth middleware runs.

AML.T0049

Impact

The workflow's active test webhook registration is cancelled, disrupting the developer's in-progress agent workflow testing session with no effect on production data or state.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 2.27.4	`2.27.4`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 27% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade n8n to 2.28.0, or to 2.27.4 if pinned to the 2.27.x branch — this is the vendor fix (GHSA-33q9-f52j-gc75). 2) Until upgraded, place n8n's REST endpoint behind a reverse proxy or firewall rule that blocks external/unauthenticated access to /${restEndpoint}/test-webhook/*, especially in multi-tenant or internet-facing deployments. 3) Avoid exposing test/dev n8n instances directly to the internet — use VPN or IP allowlisting for the builder UI and its API. 4) Detection: alert on unauthenticated DELETE requests to test-webhook endpoints in access logs/WAF, and on unexpected test-session cancellations reported by workflow developers.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass DoS Agent AML.T0029 - Denial of AI Service AML.T0049 - Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.6.2.6 - AI system security

NIST AI RMF

MANAGE-4.1 - Risk treatment for third-party AI system components

Frequently Asked Questions

What is CVE-2026-65014?

n8n registers its DELETE test-webhook/:id route before the authentication middleware runs, so any network caller who knows or guesses a workflow ID can cancel that workflow's active test webhook without credentials. n8n is a widely deployed AI agent orchestration platform with 16 tracked downstream dependents, but the blast radius here is narrow: the flaw only cancels an in-progress test session, it does not touch production webhooks, stored workflow state, or data. There is no EPSS score, it is not in CISA KEV, and no public exploit code or Nuclei template exists, so opportunistic mass exploitation is unlikely — this reads as an annoyance/DoS bug rather than a breach vector. Upgrade to n8n 2.28.0 (or 2.27.4 on the 2.27.x branch) to restore proper middleware ordering; until patched, restrict network access to the /test-webhook/ path via a reverse proxy allowlist and monitor for unauthenticated DELETE calls to that endpoint as a low-priority detection rule.

Is CVE-2026-65014 actively exploited?

No confirmed active exploitation of CVE-2026-65014 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-65014?

1) Upgrade n8n to 2.28.0, or to 2.27.4 if pinned to the 2.27.x branch — this is the vendor fix (GHSA-33q9-f52j-gc75). 2) Until upgraded, place n8n's REST endpoint behind a reverse proxy or firewall rule that blocks external/unauthenticated access to `/${restEndpoint}/test-webhook/*`, especially in multi-tenant or internet-facing deployments. 3) Avoid exposing test/dev n8n instances directly to the internet — use VPN or IP allowlisting for the builder UI and its API. 4) Detection: alert on unauthenticated DELETE requests to test-webhook endpoints in access logs/WAF, and on unexpected test-session cancellations reported by workflow developers.

What systems are affected by CVE-2026-65014?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration, webhook-triggered pipelines.

What is the CVSS score for CVE-2026-65014?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestrationwebhook-triggered pipelines

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

AML.T0049 Exploit Public-Facing Application

Compliance Controls Affected

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE-4.1

What are the technical details?

Original Advisory

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.

Exploitation Scenario

A developer at an organization is building an AI agent workflow in n8n and activates a test webhook to validate a new LLM tool-call integration. An attacker who has discovered the n8n instance is internet-reachable (e.g., via scanning or a leaked internal URL) and obtains or guesses the workflow ID sends an unauthenticated `DELETE /${restEndpoint}/test-webhook/:id` request. The request is processed before auth middleware applies, silently cancelling the developer's active test session and causing the workflow's next test invocation to fail — a nuisance/harassment-style disruption of the agent development process rather than a data or production-integrity compromise.

Weaknesses (CWE)

CWE-306 Missing Authentication for Critical Function Primary CWE-306 Missing Authentication for Critical Function CWE-306 Missing Authentication for Critical Function

CWE-306 — Missing Authentication for Critical Function: The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

[Architecture and Design] Divide the software into anonymous, normal, privileged, and administrative areas. Identify which of these areas require a proven user identity, and use a centralized authentication capability. Identify all potential communication channels, or other means of interaction with the software, to ensure that all channels are appropriately protected, including those channels that are assumed to be accessible only by authorized parties. Developers sometimes perform authentication at the primary channel, but open up a secondary channel that is assumed to be private. For example, a login mechanism may be listening on one network port, but after successful authentication, it may open up a second port where it waits for the connection, but avoids authentication because it assumes that only the authenticated party will connect to the port. In general, if the software or protocol allows a single session or user state to persist across multiple connections or channels, authentication and appropriate
[Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.

Source: MITRE CWE corpus.