CVE-2026-86993: n8n cross-project credential theft

Q: Is CVE-2026-86993 actively exploited?

No confirmed active exploitation of CVE-2026-86993 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-86993?

Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2 immediately. Until patched, restrict or revoke the custom global role(s) that grant Log Streaming scopes to any user who is not a full instance administrator, since that scope is the enabling factor here. Audit existing Log Streaming event destination configurations for credential references that don't belong to the same project as the destination, and review Log Streaming destination endpoints for any pointing to unfamiliar or external hosts. After patching, rotate any credentials that were reachable via Log Streaming destinations configured by non-admin users, and review n8n audit logs (if enabled) for Log Streaming configuration changes or credential:read access patterns inconsistent with normal usage.

Q: What systems are affected by CVE-2026-86993?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, workflow automation platforms.

Q: What is the CVSS score for CVE-2026-86993?

No CVSS score has been assigned yet.

CISO Take

n8n's Log Streaming feature let a user with a custom global role holding Log Streaming scopes name any credential ID and get its decrypted secret sent to an attacker-controlled HTTP endpoint, because the destination-credentials-access module never checked whether the caller actually owned that credential. This is a broken-access-control flaw (CWE-862), not a remote unauthenticated exploit — it requires an already-authenticated insider or compromised low-privilege account, which caps its EPSS relevance and keeps it off CISA KEV, but the blast radius inside a multi-tenant n8n instance is severe since any API key, database password, or third-party service token stored as an n8n credential in another project becomes exfiltratable. No public exploit or Nuclei template exists today, but the fix is trivial to weaponize once the diff between 1.123.75 and 1.123.76 is examined. Patch to 1.123.76, 2.37.7, or 2.38.2 immediately, and in the interim audit which non-admin users hold Log Streaming scopes and review Log Streaming destination configs for unexpected credential references or external endpoints.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity is appropriate given no public CVSS vector was published and exploitation requires an existing account with a specific custom role (credential:read scope tied to Log Streaming), not anonymous access. However, impact is high in any n8n deployment used as a shared automation platform across teams/projects, since it directly defeats project-level credential isolation — the core multi-tenancy security boundary n8n advertises. No KEV listing, no EPSS score, and no known exploit tooling mean current real-world exploitation risk is low, but the simplicity of the flaw (reference an arbitrary credential ID, no ownership check) means a motivated insider or an attacker who gains a foothold via a phished low-privilege n8n account could weaponize this in minutes.

How does the attack unfold?

Initial Access

Attacker obtains or is granted a low-privilege n8n account with a custom global role carrying Log Streaming scopes.

AML.T0012

Credential Discovery

Attacker identifies the credential ID of a valuable secret (e.g., LLM API key) belonging to another project on the shared n8n instance.

AML.T0084

Exploitation

Attacker configures a Log Streaming event destination referencing the foreign credential ID and pointing to an attacker-controlled HTTP endpoint, bypassing the missing ownership check.

AML.T0083

Impact

n8n decrypts and forwards the plaintext secret to the attacker's endpoint, enabling unauthorized use of the stolen API key or lateral compromise of downstream AI services.

AML.T0025

Initial Access

Attacker obtains or is granted a low-privilege n8n account with a custom global role carrying Log Streaming scopes.

AML.T0012

Credential Discovery

Attacker identifies the credential ID of a valuable secret (e.g., LLM API key) belonging to another project on the shared n8n instance.

AML.T0084

Exploitation

Attacker configures a Log Streaming event destination referencing the foreign credential ID and pointing to an attacker-controlled HTTP endpoint, bypassing the missing ownership check.

AML.T0083

Impact

n8n decrypts and forwards the plaintext secret to the attacker's endpoint, enabling unauthorized use of the stolen API key or lateral compromise of downstream AI services.

AML.T0025

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.76	`1.123.76`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 19% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2 immediately. Until patched, restrict or revoke the custom global role(s) that grant Log Streaming scopes to any user who is not a full instance administrator, since that scope is the enabling factor here. Audit existing Log Streaming event destination configurations for credential references that don't belong to the same project as the destination, and review Log Streaming destination endpoints for any pointing to unfamiliar or external hosts. After patching, rotate any credentials that were reachable via Log Streaming destinations configured by non-admin users, and review n8n audit logs (if enabled) for Log Streaming configuration changes or credential:read access patterns inconsistent with normal usage.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent Plugin AML.T0025 - Exfiltration via Cyber Means AML.T0055 - Unsecured Credentials AML.T0083 - Credentials from AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.8.3 - AI system data and resource security

NIST AI RMF

GOVERN-1.5 - Risk management processes address AI system access controls

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-86993?

n8n's Log Streaming feature let a user with a custom global role holding Log Streaming scopes name any credential ID and get its decrypted secret sent to an attacker-controlled HTTP endpoint, because the destination-credentials-access module never checked whether the caller actually owned that credential. This is a broken-access-control flaw (CWE-862), not a remote unauthenticated exploit — it requires an already-authenticated insider or compromised low-privilege account, which caps its EPSS relevance and keeps it off CISA KEV, but the blast radius inside a multi-tenant n8n instance is severe since any API key, database password, or third-party service token stored as an n8n credential in another project becomes exfiltratable. No public exploit or Nuclei template exists today, but the fix is trivial to weaponize once the diff between 1.123.75 and 1.123.76 is examined. Patch to 1.123.76, 2.37.7, or 2.38.2 immediately, and in the interim audit which non-admin users hold Log Streaming scopes and review Log Streaming destination configs for unexpected credential references or external endpoints.

Is CVE-2026-86993 actively exploited?

No confirmed active exploitation of CVE-2026-86993 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86993?

Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2 immediately. Until patched, restrict or revoke the custom global role(s) that grant Log Streaming scopes to any user who is not a full instance administrator, since that scope is the enabling factor here. Audit existing Log Streaming event destination configurations for credential references that don't belong to the same project as the destination, and review Log Streaming destination endpoints for any pointing to unfamiliar or external hosts. After patching, rotate any credentials that were reachable via Log Streaming destinations configured by non-admin users, and review n8n audit logs (if enabled) for Log Streaming configuration changes or credential:read access patterns inconsistent with normal usage.

What systems are affected by CVE-2026-86993?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, workflow automation platforms.

What is the CVSS score for CVE-2026-86993?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesworkflow automation platforms

MITRE ATLAS Techniques

AML.T0025 Exfiltration via Cyber Means

AML.T0055 Unsecured Credentials

AML.T0083 Credentials from AI Agent Configuration

Compliance Controls Affected

ISO 42001: A.8.3

NIST AI RMF: GOVERN-1.5

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming scopes could select a credential belonging to another project and send its decrypted secret to an attacker-controlled endpoint. The affected authorization boundary is packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts and the credential:read scope. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Exploitation Scenario

An attacker who has phished or otherwise obtained low-privilege access to an n8n instance shared across multiple teams — common in AI automation setups where one project team builds LLM-driven agent workflows and another manages internal ETL — is granted a custom global role with Log Streaming scopes for legitimate audit/logging purposes. The attacker configures a new Log Streaming event destination pointing to an attacker-controlled HTTP endpoint they host, and in the destination config references the credential ID of another project's OpenAI or Anthropic API key (IDs are often sequential or discoverable via UI enumeration). n8n's log-streaming module decrypts that credential without verifying the attacker's project owns it, and forwards the plaintext secret to the attacker's endpoint in the log stream payload. The attacker now holds a live LLM API key, which they can use to run unauthorized inference at the victim's expense, exfiltrate data the key has access to, or pivot further if the key is also used for RAG data source authentication.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.