CVE-2026-110851: n8n authorization bypass in Agents create endpoint

CVE-2026-110851 · Severity: info · Published 2026-10-14

n8n is a workflow automation platform that allows users to build and run automations. This vulnerability allows a read-only user to hijack Agents belonging to other projects by supplying an existing Agent ID, moving them into their own project and rewriting their configuration. An attacker with read-only access can escalate their privileges to modify or steal workflow automation logic across project boundaries.

Technologies: N8n. Vendors: N8n.

Quick answers

Is CVE-2026-110851 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-110851 being exploited in the wild.
How severe is CVE-2026-110851?
Informational severity, published 14 October 2026.
Which products and versions are affected?
N8n before 2.41.4 and 2.42.x before 2.42.1.
Is there a fix for CVE-2026-110851?
Yes: fixed in n8n 2.41.4, 2.42.1. Until then: Restrict n8n instance access to fully trusted users only, audit team project memberships and remove viewer access for users who should not see sensitive Agent IDs, or disable the agents module if not required. These mitigations do not fully remediate the risk and are only short-term measures. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110851 attacked?
It is attacked over the network.
Am I affected by CVE-2026-110851?
Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: n8n 2.41.4, 2.42.1

Restrict n8n instance access to fully trusted users only, audit team project memberships and remove viewer access for users who should not see sensitive Agent IDs, or disable the agents module if not required. These mitigations do not fully remediate the risk and are only short-term measures.

Technical details

The Agents create endpoint accepts a caller-supplied Agent ID and checks permissions only against the requested project, then saves with that ID, updating the existing row rather than failing. The endpoint never verifies which project owns the existing Agent. An authenticated user with read-only Agent access to one project can supply an existing Agent ID from another project to transfer ownership and modify its name, schema, and version.

Affected products

  • n8n n8n before 2.41.4 and 2.42.x before 2.42.1

Timeline

  • 2026-09-30: disclosed: GitHub Security Advisory GHSA-2r5r-xgvc-rj4p published
  • 2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.