CVE-2026-86079: n8n path injection in Elasticsearch and ElasticSecurity nodes

CVE-2026-86079 · Severity: medium · CVSS 6.5 · Published 2026-09-08

n8n is a workflow automation platform that includes nodes for interacting with Elasticsearch and ElasticSecurity. The vulnerability allows authenticated users to redirect operations intended for one document or index to unintended endpoints, including cluster administration endpoints, by manipulating index and document identifiers with path separators or dot segments. This can result in unauthorized access to sensitive data or cluster administration functions under the stored Elasticsearch credentials.

Technologies: N8n, n8n (npm). Vendors: N8n, npm.

Quick answers

Is CVE-2026-86079 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86079 being exploited in the wild.
How severe is CVE-2026-86079?
Medium severity, with a CVSS score of 6.5, published 8 September 2026.
Which products and versions are affected?
N8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2; n8n (npm) SEMVER:introduced=0,fixed=1.123.76.
Is there a fix for CVE-2026-86079?
Yes. n8n (npm): upgrade to 1.123.76 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86079 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-86079?
Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • n8n (npm): upgrade to 1.123.76 or later
    npm install n8n@1.123.76

Technical details

The Elasticsearch and ElasticSecurity nodes in n8n construct REST API endpoints by directly interpolating user-provided identifiers (index names, document IDs) into the request path without proper encoding. This path injection vulnerability (CWE-22) allows an attacker with access to n8n workflows to inject path separators ("/") or dot segments ("..") into identifier fields, causing requests to target unintended Elasticsearch endpoints or cluster administration APIs instead of the intended document. The attack requires low privileges (authenticated n8n user) and network access to the n8n instance, with no user interaction required. An attacker can read, modify, or delete data across multiple indices, or access cluster-level administrative functions, all operating under the stored Elasticsearch credentials. The fix encodes each identifier as a single URL path segment and rejects values that normalize away after encoding.

Affected products

  • n8n n8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2

Identifiers

  • CVE-2026-86079
  • GHSA-f2cp-m7mv-8jpv

Timeline

  • 2026-09-10: disclosed
  • 2026-09-10: patched: Patched in versions 1.123.76, 2.37.7, and 2.38.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.