CVE-2026-110852 n8n-io CVE debrief

Who should care

Defenders responsible for n8n deployments should assess their exposure and prioritize remediation. This includes reviewing workflows and configurations to ensure secure execution and verifying n8n versions to ensure they are up-to-date.

Why it matters

The CVE-2026-110852 vulnerability in n8n allows unauthenticated workflow execution via dynamic-path webhook resolution, posing a risk to n8n deployments. Defenders should prioritize verifying their n8n versions and upgrading to fixed versions if necessary, as well as reviewing their workflows and configurations to ensure secure execution.

• Unauthenticated workflow execution can lead to unauthorized access and data breaches
• Compromise of n8n instances can result in lateral movement and further exploitation
• Verification of n8n versions and configurations is necessary to prevent exploitation
• Remediation requires upgrading to fixed versions and reviewing workflows and configurations

Technical summary

The vulnerability in n8n allows unauthenticated workflow execution via dynamic-path webhook resolution. This is due to the software matching requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Affected versions include n8n before 1.123.83, 2.41.4, and 2.42.1. The issue enables attackers to execute workflows in unrelated projects under those projects' credentials by omitting the server-generated identifier in requests to webhook, form, or MCP routes. Defenders should prioritize verifying their n8n versions and upgrading to fixed versions if necessary, as well as reviewing their workflows and configurations to ensure secure execution.

Defensive priority

Defenders should prioritize verifying their n8n versions and upgrading to fixed versions if necessary. They should also review their workflows and configurations to ensure that they are not vulnerable to unauthenticated execution.

Recommended defensive actions

• Verify n8n version and upgrade to fixed version if necessary
• Review workflows and configurations to ensure secure execution
• Monitor for suspicious workflow execution activity
• Perform vulnerability scanning to identify potentially affected systems
• Implement compensating controls for exposed systems
• Review asset inventory to identify n8n deployments
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and references to vendor advisories. The vulnerability affects n8n versions before 1.123.83, 2.41.4, and 2.42.1. Evidence is limited to public CVE Program and NVD records. Defenders should verify n8n versions and review workflows and configurations to ensure secure execution. Limited source detail suggests verifying affected scope and severity via official advisories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.