CVE-2026-86994: n8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details. The affected paths include packages/cli/src/services/active-workflows.service.ts and packages/cli/src/workflows/workflow-push-notifier.service.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2
Event History
Frequently Asked Questions
Which users can observe information about workflows they are not authorized to access?
Any authenticated n8n member on an affected instance can receive IDs for all active workflows, regardless of workflow sharing permissions. They may also receive lifecycle events for inaccessible workflows.
What information is exposed through the affected endpoint and events?
The /rest/active-workflows endpoint exposes active workflow IDs. Activation, deactivation, and publication events can disclose workflow IDs, version IDs, and activation error details.
Which versions contain the fix?
Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2. Versions prior to those releases are affected.