AI Threat Alert
n8n's Elasticsearch and ElasticSecurity nodes built REST request paths by directly interpolating workflow-supplied index and document identifiers, without encoding path separators or dot segments — so a crafted identifier could redirect the request to a different index or to a cluster administration endpoint, all under the authority of the stored Elasticsearch credential. There's no CVSS score, EPSS data, KEV listing, or public exploit yet, and the affected package's own risk score is 0/100, but the failure mode is a straightforward path traversal (CWE-22) in a widely-used automation platform where Elasticsearch commonly backs search or RAG-style AI workflows — meaning the blast radius extends to whatever indices that credential can reach, including sensitive or unrelated tenant data. Anyone who can edit a workflow or influence its inputs (via a form trigger, webhook, or shared template) gets an unintended pivot point into the Elasticsearch cluster, effectively bypassing the intended scope of the stored credential. Patch to n8n 1.123.76, 2.37.7, or 2.38.2 immediately; until then, scope the Elasticsearch credential to the minimum required index/permissions via Elasticsearch's own security roles, and restrict who can author or edit workflows that use these nodes. For detection, review Elasticsearch access logs for requests from the n8n service account hitting `_cluster`, `_cat`, or index paths outside the expected set.
What is the risk?
Unrated by CVSS/EPSS and not in CISA KEV, with no public exploit or Nuclei template — so near-term mass exploitation is unlikely. However, the underlying flaw (unsanitized identifier interpolation into a REST path) is trivial to exploit once an attacker can influence workflow inputs or node configuration, and the impact scales with how broad the stored Elasticsearch credential's permissions are. Risk is best characterized as low-to-moderate likelihood but potentially high impact in n8n deployments where Elasticsearch credentials are over-privileged or shared across tenants/workflows, and higher still where Elasticsearch also backs a RAG/vector search layer for an AI agent.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | < 1.123.76 | 1.123.76 |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 step-
1) Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2, which add proper path-segment encoding in packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts. 2) Until patched, restrict the Elasticsearch credential used by n8n to the minimum index scope and disable cluster-admin privileges via Elasticsearch role-based access control. 3) Restrict workflow-edit permissions in n8n to trusted users, since exploitation requires control over the index/document identifier passed to the node. 4) Monitor Elasticsearch access/audit logs for the n8n service account issuing requests to unexpected indices or
_cluster/_catendpoints. 5) Review any workflows that populate the Elasticsearch node's index/document ID fields from user-supplied or external input (webhooks, forms, third-party data) and treat those as high risk until patched.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-86079?
n8n's Elasticsearch and ElasticSecurity nodes built REST request paths by directly interpolating workflow-supplied index and document identifiers, without encoding path separators or dot segments — so a crafted identifier could redirect the request to a different index or to a cluster administration endpoint, all under the authority of the stored Elasticsearch credential. There's no CVSS score, EPSS data, KEV listing, or public exploit yet, and the affected package's own risk score is 0/100, but the failure mode is a straightforward path traversal (CWE-22) in a widely-used automation platform where Elasticsearch commonly backs search or RAG-style AI workflows — meaning the blast radius extends to whatever indices that credential can reach, including sensitive or unrelated tenant data. Anyone who can edit a workflow or influence its inputs (via a form trigger, webhook, or shared template) gets an unintended pivot point into the Elasticsearch cluster, effectively bypassing the intended scope of the stored credential. Patch to n8n 1.123.76, 2.37.7, or 2.38.2 immediately; until then, scope the Elasticsearch credential to the minimum required index/permissions via Elasticsearch's own security roles, and restrict who can author or edit workflows that use these nodes. For detection, review Elasticsearch access logs for requests from the n8n service account hitting `_cluster`, `_cat`, or index paths outside the expected set.
Is CVE-2026-86079 actively exploited?
No confirmed active exploitation of CVE-2026-86079 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-86079?
1) Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2, which add proper path-segment encoding in packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts. 2) Until patched, restrict the Elasticsearch credential used by n8n to the minimum index scope and disable cluster-admin privileges via Elasticsearch role-based access control. 3) Restrict workflow-edit permissions in n8n to trusted users, since exploitation requires control over the index/document identifier passed to the node. 4) Monitor Elasticsearch access/audit logs for the n8n service account issuing requests to unexpected indices or `_cluster`/`_cat` endpoints. 5) Review any workflows that populate the Elasticsearch node's index/document ID fields from user-supplied or external input (webhooks, forms, third-party data) and treat those as high risk until patched.
What systems are affected by CVE-2026-86079?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, vector databases.
What is the CVSS score for CVE-2026-86079?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0053 AI Agent Tool Invocation AML.T0086 Exfiltration via AI Agent Tool Invocation Compliance Controls Affected
What are the technical details?
Original Advisory
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Exploitation Scenario
An attacker with the ability to edit an n8n workflow — or to supply input consumed by one (e.g., via a public webhook or form trigger that feeds the Elasticsearch node's index/document ID field) — crafts an identifier such as `../_cluster/settings` or `../other-tenant-index/_search`. Because the node concatenates this value directly into the REST request path without encoding, the request escapes the intended index scope and is executed with the full authority of the stored Elasticsearch credential. Depending on the credential's permissions, the attacker can read documents from a different tenant's index (data leakage into whatever the workflow does next, including an AI agent's context) or reach cluster administration functionality, potentially altering cluster-wide settings.
Weaknesses (CWE)
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Primary
CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-22 — Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'): The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
- [Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
- [Architecture and Design] For any security checks that are performed on the client side, ensure that these checks are duplicated on the server side, in order to avoid CWE-602. Attackers can bypass the client-side checks by modifying values after the checks have been performed, or by changing the client to remove the client-side checks entirely. Then, these modified values would be submitted to the server.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-33663 10.0 n8n: member role steals plaintext HTTP credentials
Same package: n8n CVE-2026-33660 10.0 TensorFlow: type confusion NPD in tensor conversion
Same package: n8n CVE-2026-21858 10.0 n8n: Input Validation flaw enables exploitation
Same package: n8n CVE-2025-68668 9.9 n8n: Protection Bypass circumvents security controls
Same package: n8n CVE-2026-27495 9.9 n8n: Code Injection enables RCE
Same package: n8n