Auth bypass in N8n-io N8n
CVE-2026-65014
n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to…
Vulnerability class: Broken Authentication
Affected products
- N8n-io N8n — versions 0, 2.28.0, 2.27.4
Weakness classification (CWE)
References
- disclosure@vulncheck.com (vendor-advisory)
- disclosure@vulncheck.com (third-party-advisory)