CVE-2026-86993: n8n log streaming credentials unauthorized access

CVE-2026-86993 · Severity: medium · CVSS 4.9 · Published 2026-09-08

n8n is a low-code automation platform that allows users to configure log streaming to external endpoints using HTTP credentials. A flaw in access control allows users with log streaming permissions to decrypt and exfiltrate credentials belonging to other projects, potentially exposing API keys and authentication secrets to attacker-controlled endpoints. This could lead to unauthorized access to backend systems and data theft.

Technologies: N8n, n8n (npm). Vendors: N8n, npm.

Quick answers

Is CVE-2026-86993 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86993 being exploited in the wild.
How severe is CVE-2026-86993?
Medium severity, with a CVSS score of 4.9, published 8 September 2026.
Which products and versions are affected?
N8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2; n8n (npm) SEMVER:introduced=0,fixed=1.123.76.
Is there a fix for CVE-2026-86993?
Yes. n8n (npm): upgrade to 1.123.76 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86993 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-86993?
Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • n8n (npm): upgrade to 1.123.76 or later
    npm install n8n@1.123.76

Technical details

The vulnerability is a missing authorization check (CWE-862) in n8n's log streaming event destination credential resolution. When a log streaming destination references a generic HTTP credential, the system resolves and decrypts the credential without verifying the caller has project-scoped access to it. An attacker with a custom global role holding log streaming scopes (`eventBusDestination:create`, `eventBusDestination:test`, etc.) can craft a request naming a credential from another project, causing the system to decrypt it and transmit the plaintext secret to an endpoint they control. Attack vector is network-based, requires high privilege (custom role grant), low complexity, and no user interaction. The fix applies standard credential access control checks during credential resolution. Patch versions: 1.123.76, 2.37.7, 2.38.2.

Affected products

  • n8n n8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2

Identifiers

  • CVE-2026-86993
  • GHSA-pq6c-vh67-xpm3

Timeline

  • 2026-09-10: disclosed
  • 2026-09-10: patched: Patches released in versions 1.123.76, 2.37.7, and 2.38.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.