CVE-2026-110852
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass…
- Risk score
- 43/100
- CVSS
- 6.3 v4.0
- Exploit chance (30 days)
- 0.4%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in req…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.123.83, 2.41.4, 2.42 or 2.42.1 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.3 medium
References
Original description
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.
Last activity 14 Oct 2026. Patch Forecast updates every hour.