CVE-2026-86079: n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2
Event History
Frequently Asked Questions
Which deployments are affected?
n8n deployments running versions earlier than 1.123.76, 2.37.7, or 2.38.2 are affected when using the Elasticsearch or ElasticSecurity nodes. The issue applies to requests that use workflow-controlled index or document identifiers.
What does an attacker need to exploit this issue?
An attacker needs the ability to control an index or document identifier used by an Elasticsearch or ElasticSecurity workflow node. Identifiers containing path separators or dot segments can alter the REST path sent using the stored Elasticsearch credential.
What could the altered request reach?
The crafted identifier could select a different Elasticsearch index or reach a cluster administration endpoint. Any access is performed with the permissions of the Elasticsearch credential stored in n8n.
What should be done to remediate the issue?
Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2. These releases add the missing path-segment encoding for the affected request construction.