EUVD-2026-47630
GHSA-h9fm-xcv2-qfw3
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the workflow-ID prerequisite (analogous to CVSS 4.0 AT:P); no confidentiality or integrity impact applies.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.
AnalysisAI
Unauthenticated cancellation of active test webhook sessions is possible in n8n prior to 2.28.0 (and prior to 2.27.4 on the 2.27.x branch) because the DELETE test-webhook endpoint is registered before the authentication middleware stack, making it reachable by any network caller who possesses a valid workflow ID. The impact is deliberately scoped: only in-progress developer test sessions can be disrupted; production webhooks, persistent workflow state, and stored data are explicitly unaffected per the vendor advisory. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS 4.0 AT:P qualifier confirms a workflow-ID prerequisite limits opportunistic mass exploitation.
Technical ContextAI
n8n is a Node.js-based workflow automation platform (CPE: cpe:2.3:a:n8n-io:n8n) that exposes a configurable REST API for webhook lifecycle management. The root cause is CWE-306 (Missing Authentication for Critical Function): in Node.js HTTP frameworks such as Express, route handler registration is strictly order-dependent - any route mounted before the authentication middleware executes without credential checks. The affected endpoint DELETE /${restEndpoint}/test-webhook/:id was placed in the route registration sequence ahead of the auth middleware, creating an authentication bypass limited to that single endpoint. The :id path parameter corresponds to the workflow ID, which serves as an implicit, non-cryptographic identifier rather than an access-control token.
RemediationAI
The primary fix is to upgrade n8n to version 2.28.0 or later; users on the 2.27.x branch should upgrade to 2.27.4 at minimum. The vendor advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75 confirms these fix versions. The upstream fix repositions the DELETE test-webhook endpoint registration to occur after authentication middleware, eliminating the bypass. If an immediate upgrade is not feasible, a targeted compensating control is to restrict network access to the n8n REST API port to trusted IP ranges using a reverse proxy ACL or host-based firewall rule, preventing unauthenticated external callers from reaching the endpoint. This mitigates external exploitation but does not protect against insider threats or attackers already on the same network segment; the trade-off is reduced developer accessibility from outside approved subnets.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today