CVE-2026-65014 n8n-io CVE debrief

Who should care

Users of n8n before version 2.28.0 (and before 2.27.4 on the 2.27.x branch) should be aware of this vulnerability and take steps to upgrade or mitigate. This includes administrators and security teams responsible for n8n instances, especially those exposed to the internet or untrusted networks.

Technical summary

The vulnerability exists in the DELETE /${restEndpoint}/test-webhook/:id endpoint, which is registered before authentication middleware is applied. This allows any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The endpoint's early registration poses a risk of unauthorized workflow test cancellation. Affected users of n8n before version 2.28.0 (and before 2.27.4 on the 2.27.x branch) should be aware of this vulnerability and take steps to upgrade or mitigate, especially for exposed or internet-facing n8n instances, to prevent disruption of in-progress test sessions.

Defensive priority

Medium priority given the limited impact and CVSS score of 6.3, but high priority for exposed or internet-facing n8n instances.

Recommended defensive actions

• Upgrade to n8n version 2.28.0 or later
• Limit network exposure to the n8n instance
• Monitor for suspicious DELETE requests to the /test-webhook/ endpoint
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-07-22T12:18:18.453Z and last modified on 2026-07-22T16:27:18.220Z. The NVD entry is currently Undergoing Analysis. This CVE is related to an authentication bypass vulnerability in n8n before 2.28.0. The vulnerability allows unauthenticated network callers to cancel active test webhook registrations given a workflow ID. Evidence is limited to public CVE and NVD information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.