AI Threat AlertCVE-2026-85173: n8n: IDOR exposes workflow data across projects
MEDIUMn8n's Insights API fails to check project membership before returning workflow names and execution statistics, letting any authenticated user with insights scope pull data from projects they don't belong to simply by supplying a different projectId. n8n sits in the agent-framework category with 16 downstream dependents and a history of 211 other CVEs in the package, and while this flaw carries no CVSS score, EPSS rating, or CISA KEV listing, its low complexity — no special tooling or AI expertise required — makes it trivial to abuse in any multi-tenant n8n deployment. For CISOs running shared or MSP-style n8n instances, the exposure means other teams, contractors, or malicious insiders sharing the platform can enumerate other tenants' AI automation workflows and execution history, which often reveals business logic, integration names, and operational cadence useful for follow-on attacks. Patch to n8n 2.36.2 or later; until then, audit which users hold insights scope, restrict it to trusted admins, and review Insights API access logs for projectId values outside a user's assigned projects.
What is the risk?
Medium risk despite the absence of a published CVSS score or EPSS percentile. This is a straightforward IDOR-class authorization bypass (CWE-639, missing per-project access control) requiring only a valid authenticated account with insights scope — no privilege escalation and no advanced AI/ML knowledge needed to exploit. Impact is limited to information disclosure (workflow names, execution statistics) rather than code execution or data modification, but n8n's package risk score of 69/100 and history of 211 prior CVEs in the same package signal a platform with a broad and recurring attack surface. Not in CISA KEV, no public exploit or Nuclei template identified, so this reads as an insider/multi-tenant risk rather than an internet-scanning threat today.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 stepUpgrade n8n to version 2.36.2 or later, where per-project authorization is enforced on Insights API routes. Until patched, minimize the number of users granted the 'insights' scope and restrict it to trusted administrators — this scope is the sole prerequisite for exploitation. Audit project membership assignments to confirm they match intended tenant boundaries, and review Insights API access logs for requests carrying a projectId that doesn't match the requesting user's assigned project(s), the clearest indicator of exploitation attempts. Reference the vendor advisory (GHSA-jmmj-93rg-6j39) and VulnCheck writeup for technical detail during patch validation.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-85173?
n8n's Insights API fails to check project membership before returning workflow names and execution statistics, letting any authenticated user with insights scope pull data from projects they don't belong to simply by supplying a different projectId. n8n sits in the agent-framework category with 16 downstream dependents and a history of 211 other CVEs in the package, and while this flaw carries no CVSS score, EPSS rating, or CISA KEV listing, its low complexity — no special tooling or AI expertise required — makes it trivial to abuse in any multi-tenant n8n deployment. For CISOs running shared or MSP-style n8n instances, the exposure means other teams, contractors, or malicious insiders sharing the platform can enumerate other tenants' AI automation workflows and execution history, which often reveals business logic, integration names, and operational cadence useful for follow-on attacks. Patch to n8n 2.36.2 or later; until then, audit which users hold insights scope, restrict it to trusted admins, and review Insights API access logs for projectId values outside a user's assigned projects.
Is CVE-2026-85173 actively exploited?
No confirmed active exploitation of CVE-2026-85173 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-85173?
Upgrade n8n to version 2.36.2 or later, where per-project authorization is enforced on Insights API routes. Until patched, minimize the number of users granted the 'insights' scope and restrict it to trusted administrators — this scope is the sole prerequisite for exploitation. Audit project membership assignments to confirm they match intended tenant boundaries, and review Insights API access logs for requests carrying a projectId that doesn't match the requesting user's assigned project(s), the clearest indicator of exploitation attempts. Reference the vendor advisory (GHSA-jmmj-93rg-6j39) and VulnCheck writeup for technical detail during patch validation.
What systems are affected by CVE-2026-85173?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation pipelines, multi-tenant SaaS platforms.
What is the CVSS score for CVE-2026-85173?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0084Discover AI Agent ConfigurationAML.T0085Data from AI ServicesCompliance Controls Affected
What are the technical details?
Original Advisory
n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated users with insights scopes to access workflow names and execution statistics across projects. Attackers can supply arbitrary projectId parameters to retrieve sensitive project and workflow information from projects they have no membership in.
Exploitation Scenario
A contractor or client with legitimate but limited access to a shared n8n instance — granted the 'insights' scope for their own project's reporting — notices the Insights API accepts a projectId parameter. By incrementing or guessing projectId values, they retrieve workflow names and execution statistics belonging to other tenants on the same instance, including a competitor's or another department's AI agent automations. No credentials are stolen and no code executes, but the attacker walks away with a map of which AI workflows exist, how active they are, and naming conventions that hint at their purpose — intelligence that can inform a targeted phishing or follow-on technical attack against the exposed tenant.
Weaknesses (CWE)
CWE-639Authorization Bypass Through User-Controlled KeyCWE-639Authorization Bypass Through User-Controlled KeyCWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- [Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- [Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2025-686689.9n8n: Protection Bypass circumvents security controls
Same package: n8nCVE-2026-274959.9n8n: Code Injection enables RCE
Same package: n8n