CVE-2026-86073 n8n-io CVE debrief

Who should care

Defenders responsible for n8n workflow automation platforms, especially those using OAuth for authentication, should assess exposure and verify that their instances are upgraded to a fixed version.

Why it matters

CVE-2026-86073 allows an OAuth client approved for one n8n workflow to potentially access an unapproved workflow, increasing the risk of unauthorized access or data breaches. Defenders should verify exposure, upgrade to a fixed version, and restrict workflow access.

• Potential unauthorized access to sensitive workflows
• Lateral movement within n8n workflows
• Increased risk of data breaches or unauthorized modifications
• Verification of OAuth client configurations and workflow access controls

Technical summary

The n8n OAuth token endpoint did not properly bind refresh tokens to the consented resource, allowing an OAuth client approved for one workflow to obtain a valid token for an unapproved workflow accessible to the consenting user. This issue arises from the token endpoint's implementation, which fails to validate the resource parameter for refresh tokens, potentially leading to unauthorized access or data breaches in n8n workflow automation platforms using OAuth for authentication. The vulnerability exists in n8n versions prior to 2.37.7 and 2.38.1.

Defensive priority

Defenders should prioritize verifying exposure in n8n workflows using OAuth, especially where multiple workflows are accessible to the same consenting user.

Recommended defensive actions

• Verify n8n version and upgrade to 2.37.7 or 2.38.1 if necessary
• Review OAuth client configurations and restrict workflow access
• Monitor workflow usage and audit OAuth token usage
• Perform a thorough review of workflow access controls and OAuth client configurations
• Implement additional monitoring and logging to detect potential unauthorized access
• Conduct a security audit to identify potential vulnerabilities in n8n workflows
• Develop and implement a plan to rapidly respond to potential security incidents

Evidence notes

The CVE record and NVD entry provide details on the OAuth token endpoint vulnerability in n8n versions prior to 2.37.7 and 2.38.1. Limited information is available on actual exploitation or victim impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.