Vulnerability in N8n-Io N8n

CVE-2026-110852

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.

Published 2026-10-14 · last modified 2026-10-15.

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

N8n-Io N8n

Weakness classification (CWE)

CWE-288 — Authentication Bypass Using an Alternate Path or Channel

References

github.com/n8n-io/n8n/security/advisories/GHSA-4c7j-qff5-r9cx (vendor-advisory)
www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-unauthentica… (third-party-advisory)