CVE-2026-110852: n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution

Severity: medium (CVSS 6.3 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-14 · updated 2026-10-15
Weakness: CWE-288

Description

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.

Affected products

n8n-io n8n: before 1.123.83; from 2.0.0 before 2.41.4; from 2.42.0 before 2.42.1 — fixed in 1.123.83, 2.41.4, 2.42.1

How to fix

Upgrade to a fixed version: n8n-io n8n 1.123.83, 2.41.4, 2.42.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-110852 or the next vulnerability affects your stack