n8n CVE-2026-110852

Exploitation requires the target n8n instance (before 1.123.83, 2.x before 2.41.4, or 2.42.x before 2.42.1) to have at least one deployed workflow using a dynamic-path webhook, form, or MCP trigger - these are the routes where path-only matching ignores the server-generated identifier. No authentication, credentials, or user interaction are needed, and the normally unguessable per-webhook identifier can simply be omitted, so the attacker only needs to reach the route and know/guess its path component. Limiting factors: the vulnerable trigger type must actually be configured (captured by AT:P), the instance must be network-reachable, and impact is bounded to the credentials and workflows of the affected projects rather than the underlying host.

This is a genuine but moderate-priority issue. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N) describes a remotely reachable, low-complexity, unauthenticated flaw, which normally signals urgency; however, the base score is only 6.3 (Medium) because every impact metric is capped at Low (VC:L/VI:L/VA:N, SC:L/SI:L/SA:N) and an Attack Requirement is present (AT:P), meaning exploitation depends on a deployment condition outside the attacker's control. The net effect is an unauthenticated cross-project authorization bypass whose blast radius is bounded by whatever a given project's credentials and workflows can reach - potentially serious in data-rich automation environments, but not full compromise of the host. No EPSS score was provided in the input, so exploitation probability cannot be quantified; it is not listed in CISA KEV; and no public exploit was identified in the supplied intelligence (POC status is effectively unknown and should be treated as none). Signals are therefore internally consistent rather than conflicting: no data point elevates this above its Medium rating. Treat it as a prompt-patch item - especially for internet-exposed n8n instances using dynamic-path webhook/form/MCP triggers - rather than an emergency.

An attacker who can reach an internet-exposed n8n instance sends a request to a webhook, form, or MCP route but omits the server-generated unguessable identifier, relying on the fact that resolution matches on the path alone. The request is matched to a workflow in an unrelated project and executed under that project's credentials, letting the attacker trigger automations and access resources they were never authorized for. No authentication or user interaction is required, though a workflow using a dynamic-path trigger must be deployed; no public exploit was identified at time of analysis.