CVE-2026-110852: n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Path Webhook Resolution
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.
Affected Software
Event History
Frequently Asked Questions
Which n8n deployments are exposed?
Deployments running versions before 1.123.83, 2.41.4, or 2.42.1 are affected. The exposed functionality includes dynamic-path webhook, form, and MCP routes.
What does an attacker need to exploit this issue?
An attacker can be unauthenticated and can omit the server-generated identifier from requests to affected routes. The flaw occurs because route resolution matched the path while ignoring that identifier.
What is the impact of successful exploitation?
An attacker can execute workflows belonging to unrelated projects. Those workflows run under the credentials associated with the affected projects.
What should be prioritized if remediation is required?
Upgrade affected n8n instances to a fixed version: 1.123.83, 2.41.4, or 2.42.1, as applicable. Prioritize instances that expose dynamic-path webhook, form, or MCP routes.