CVE-2026-86994: n8n broken authZ leaks workflow IDs

Q: Is CVE-2026-86994 actively exploited?

No confirmed active exploitation of CVE-2026-86994 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-86994?

Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2, which fix the authorization checks in active-workflows.service.ts and workflow-push-notifier.service.ts. Until patched, treat any multi-tenant or cross-team n8n instance as having weakened workflow confidentiality boundaries — avoid relying on sharing settings alone to hide the existence of sensitive workflows, and consider network-level or instance-level segregation for high-sensitivity tenants. Post-patch, monitor for unusual call patterns to /rest/active-workflows from accounts with narrow workflow grants, and review WebSocket/push notification logs for evidence of broad broadcast prior to the fix.

Q: What systems are affected by CVE-2026-86994?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration.

Q: What is the CVSS score for CVE-2026-86994?

No CVSS score has been assigned yet.

CISO Take

n8n's /rest/active-workflows endpoint and its real-time push notification system failed to enforce workflow-sharing permissions, returning every active workflow ID on an instance — plus version IDs and activation error details — to any authenticated member, regardless of whether they had access to that workflow. There's no CVSS score, no EPSS data, no public exploit, and it isn't in CISA KEV, so this is not an actively-exploited or high-complexity bug — it's a straightforward missing-authorization flaw (CWE-862) exploitable by any low-privileged, authenticated instance user with zero special tooling. The real exposure is for organizations running n8n as a shared, multi-tenant automation or AI-agent orchestration platform, where workflow visibility is relied on as a confidentiality boundary between teams or customers; leaked workflow/version IDs and error details give an insider or compromised low-privilege account a reconnaissance map of automations they shouldn't know exist. Patch to n8n 1.123.76, 2.37.7, or 2.38.2 immediately on any multi-tenant or shared instance, and review audit logs for anomalous calls to /rest/active-workflows from accounts with limited workflow sharing.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity is appropriate: this is an authorization-boundary failure (CWE-862) with a small blast radius — it discloses metadata (workflow IDs, version IDs, activation error text), not workflow contents, credentials, or execution capability. Exploitability is trivial (any authenticated instance member, no special skill or tooling required) and requires no user interaction, but impact is limited to information disclosure rather than code execution or data exfiltration. No EPSS score, no KEV listing, and no public PoC/scanner exist, indicating no evidence of active or opportunistic exploitation. Risk rises meaningfully in multi-tenant or customer-isolated n8n deployments where workflow sharing is used as a confidentiality control between business units or clients.

How does the attack unfold?

Initial Access

Attacker authenticates as a low-privileged member of a shared n8n instance without access grants to a specific AI agent workflow.

Reconnaissance

Attacker queries /rest/active-workflows, which returns every active workflow ID on the instance regardless of sharing permissions.

AML.T0084

Information Disclosure

Attacker passively receives push notifications for workflow activation, deactivation, and publication events they aren't authorized to see, exposing version IDs and activation error details.

AML.T0084

Impact

Attacker compiles a map of the organization's AI agent workflows and their operational status, enabling targeted follow-on attacks or leaking automation business intelligence.

Initial Access

Attacker authenticates as a low-privileged member of a shared n8n instance without access grants to a specific AI agent workflow.

Reconnaissance

Attacker queries /rest/active-workflows, which returns every active workflow ID on the instance regardless of sharing permissions.

AML.T0084

Information Disclosure

Attacker passively receives push notifications for workflow activation, deactivation, and publication events they aren't authorized to see, exposing version IDs and activation error details.

AML.T0084

Impact

Attacker compiles a map of the organization's AI agent workflows and their operational status, enabling targeted follow-on attacks or leaking automation business intelligence.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.76	`1.123.76`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.2%

chance of exploitation in 30 days

Higher than 10% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2, which fix the authorization checks in active-workflows.service.ts and workflow-push-notifier.service.ts. Until patched, treat any multi-tenant or cross-team n8n instance as having weakened workflow confidentiality boundaries — avoid relying on sharing settings alone to hide the existence of sensitive workflows, and consider network-level or instance-level segregation for high-sensitivity tenants. Post-patch, monitor for unusual call patterns to /rest/active-workflows from accounts with narrow workflow grants, and review WebSocket/push notification logs for evidence of broad broadcast prior to the fix.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent AML.T0084 - Discover AI Agent Configuration

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 9 - Risk Management System

NIST AI RMF

GOVERN 1.5 - Access control and accountability mechanisms for AI system components

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-86994?

n8n's /rest/active-workflows endpoint and its real-time push notification system failed to enforce workflow-sharing permissions, returning every active workflow ID on an instance — plus version IDs and activation error details — to any authenticated member, regardless of whether they had access to that workflow. There's no CVSS score, no EPSS data, no public exploit, and it isn't in CISA KEV, so this is not an actively-exploited or high-complexity bug — it's a straightforward missing-authorization flaw (CWE-862) exploitable by any low-privileged, authenticated instance user with zero special tooling. The real exposure is for organizations running n8n as a shared, multi-tenant automation or AI-agent orchestration platform, where workflow visibility is relied on as a confidentiality boundary between teams or customers; leaked workflow/version IDs and error details give an insider or compromised low-privilege account a reconnaissance map of automations they shouldn't know exist. Patch to n8n 1.123.76, 2.37.7, or 2.38.2 immediately on any multi-tenant or shared instance, and review audit logs for anomalous calls to /rest/active-workflows from accounts with limited workflow sharing.

Is CVE-2026-86994 actively exploited?

No confirmed active exploitation of CVE-2026-86994 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86994?

Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2, which fix the authorization checks in active-workflows.service.ts and workflow-push-notifier.service.ts. Until patched, treat any multi-tenant or cross-team n8n instance as having weakened workflow confidentiality boundaries — avoid relying on sharing settings alone to hide the existence of sensitive workflows, and consider network-level or instance-level segregation for high-sensitivity tenants. Post-patch, monitor for unusual call patterns to /rest/active-workflows from accounts with narrow workflow grants, and review WebSocket/push notification logs for evidence of broad broadcast prior to the fix.

What systems are affected by CVE-2026-86994?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration.

What is the CVSS score for CVE-2026-86994?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration

MITRE ATLAS Techniques

AML.T0084 Discover AI Agent Configuration

Compliance Controls Affected

EU AI Act: Article 9

NIST AI RMF: GOVERN 1.5

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details. The affected paths include packages/cli/src/services/active-workflows.service.ts and packages/cli/src/workflows/workflow-push-notifier.service.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Exploitation Scenario

An attacker with a valid but low-privileged n8n account (e.g., a contractor, a compromised low-tier employee credential, or a tenant in a shared instance) calls /rest/active-workflows and receives the full list of active workflow IDs across the entire instance, including workflows explicitly not shared with them — among them, an AI agent workflow orchestrating an internal LLM-based customer support or data-processing pipeline. The attacker also passively observes push notification broadcasts as that workflow is activated, deactivated, or republished, learning its version ID and any activation error text. Using this reconnaissance, the attacker maps out which AI automations exist, their update cadence, and potential misconfiguration signals (via error details) — intelligence that can be used to target further attacks (e.g., probing for other IDOR or privilege-escalation bugs against those specific workflow IDs) or simply to exfiltrate competitive/operational intelligence about the victim's automation footprint.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.