CVE-2026-86074 n8n-io CVE debrief

Who should care

Defenders responsible for n8n instances, particularly those using versions prior to 2.37.7 and 2.38.2, should assess their exposure and prioritize patching to prevent potential security risks.

Why it matters

CVE-2026-86074 is a vulnerability in the n8n workflow automation platform that allows for potential security risks due to improper validation of credential test or verification URLs. Defenders responsible for n8n instances should assess their exposure and prioritize patching to prevent potential security risks.

• Potential for authenticated requests, redirects, or probes to reach another origin
• Risk of security consequences if exploited
• Need for verification of n8n instance versions and application of patches

Technical summary

The n8n workflow automation platform, prior to versions 2.37.7 and 2.38.2, contains a vulnerability that allows for potential security risks due to improper validation of credential test or verification URLs. This issue could lead to security consequences if exploited, including authenticated requests, redirects, or probes to reach another origin. The vulnerability is caused by the Instance AI credential setup flow accepting a credential test or verification URL without checking that it matched the workflow node's origin. Attackers could manipulate URLs, leading to security risks. Defenders should prioritize verifying their n8n instance versions and applying the necessary patches to prevent potential security

Defensive priority

Defenders should prioritize verifying their n8n instance versions and applying the necessary patches to prevent potential security risks.

Recommended defensive actions

• Verify n8n instance versions and apply patches to prevent potential security risks
• Review and update credential test or verification URLs to ensure they match the workflow node's origin
• Monitor n8n instance for any suspicious activity
• Perform a thorough review of the n8n workflow automation platform's configuration and security controls
• Implement additional security measures, such as input validation and URL sanitization
• Conduct regular security audits and vulnerability assessments
• Develop an incident response plan in case of a potential security breach

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. The vulnerability is caused by the Instance AI credential setup flow accepting a credential test or verification URL without checking that it matched the workflow node's origin. This could influence that URL after a user injected it into the setup flow, causing authenticated requests, redirects, or probes to reach another origin. Evidence is limited to public CVE and NVD records; defenders should verify n8n

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.