Executive brief
n8n is a workflow automation platform that enables users to create and manage automated tasks and data integrations. A flaw in the source control feature allows authenticated project administrators to delete workflows and credentials from projects they don't have access to, bypassing normal authorization controls. This could result in data loss and service disruption for other projects within the same n8n instance when the enterprise source control feature is enabled.
Technical details
The vulnerability is an improper authorization flaw (CWE-639) in the source control push endpoint. The endpoint incorrectly derives the set of files to push from client-supplied file paths and status in the request payload, rather than validating against server-side authorization state for the requesting user. An authenticated project-scoped user (such as a project admin) can craft a malicious push request referencing files from projects they lack access to, enabling deletion of those projects' workflows and credentials. Exploitation requires network access to the n8n instance, project-scoped user credentials, and the enterprise Source Control (Environments) feature to be licensed, enabled, and connected to a remote repository. The issue is patched in versions 1.123.76, 2.37.7, and 2.38.2.
Affected products
- n8n n8n before 1.123.76, 2.37.7, and 2.38.2
Timeline
- 2026-09-16: disclosed
- 2026-09-16: patched: Patched in versions 1.123.76, 2.37.7, and 2.38.2