Executive brief
n8n is a popular workflow automation and integration platform. A missing authorization flaw allowed any authenticated user to view a complete list of all active workflows on the instance and receive real-time notifications about workflow lifecycle events, regardless of whether they had permission to access those workflows. This enables users to discover and monitor workflows created by other users, potentially exposing sensitive business logic and operational details.
Technical details
The vulnerability is a missing authorization (CWE-862) affecting the `/rest/active-workflows` endpoint and workflow lifecycle event broadcasting in n8n. Any authenticated user (member role) could enumerate all active workflows on the instance without respecting the sharing service controls, and push events for workflow activation, deactivation, and publication were broadcast to all connected clients regardless of access level, exposing workflow IDs, version IDs, and error details. The root cause is the absence of userId filtering in the endpoint and event handlers. Exploitation requires valid authentication (low privilege: member role) and network access to the n8n instance; no user interaction or system privilege escalation is needed. An attacker with a member account can discover workflows they should not have access to and monitor their activity. The issue has been patched in n8n versions 1.123.76, 2.37.7, and 2.38.2 by scoping workflows and events through the sharing service. Temporary mitigation involves restricting instance access to trusted users and avoiding global:member provisioning for untrusted accounts.
Affected products
- n8n n8n < 1.123.76, >= 2.0.0 < 2.37.7, >= 2.38.0 < 2.38.2
Timeline
- 2026-09-10: disclosed: Public advisory published by GitHub
- 2026-09-02: patched: Patched in versions 1.123.76, 2.37.7, and 2.38.2
- 2026-09-08: other: CVE-2026-86994 published by NVD