Executive brief
n8n is a workflow automation platform that includes nodes for interacting with Elasticsearch and ElasticSecurity. The vulnerability allows authenticated users to redirect operations intended for one document or index to unintended endpoints, including cluster administration endpoints, by manipulating index and document identifiers with path separators or dot segments. This can result in unauthorized access to sensitive data or cluster administration functions under the stored Elasticsearch credentials.
Technical details
The Elasticsearch and ElasticSecurity nodes in n8n construct REST API endpoints by directly interpolating user-provided identifiers (index names, document IDs) into the request path without proper encoding. This path injection vulnerability (CWE-22) allows an attacker with access to n8n workflows to inject path separators ("/") or dot segments ("..") into identifier fields, causing requests to target unintended Elasticsearch endpoints or cluster administration APIs instead of the intended document. The attack requires low privileges (authenticated n8n user) and network access to the n8n instance, with no user interaction required. An attacker can read, modify, or delete data across multiple indices, or access cluster-level administrative functions, all operating under the stored Elasticsearch credentials. The fix encodes each identifier as a single URL path segment and rejects values that normalize away after encoding.
Affected products
- n8n n8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Patched in versions 1.123.76, 2.37.7, and 2.38.2