GHSA-65xw-2v52-jhxc: Npm/n8n vulnerability
Impact
The endpoint /rest/active-workflows returned every active workflow ID on the instance to any member, regardless of sharing, and workflow activation, deactivation and publication push events were broadcast to every connected client, carrying workflow IDs, version IDs and activation-error detail across users. The patch scopes both the listing and the push events through the sharing service, so a user only sees workflows they can access.
Patches
The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Avoid provisioning global:member accounts for untrusted users until the instance is patched.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.123.76 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.37.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.38.2 - Compensating control
Avoid provisioning `global:member` accounts for untrusted users until the n8n instance is patched.
- Compensating control
Restrict n8n instance access to fully trusted users only (temporary mitigation until upgraded).
Event History
Frequently Asked Questions
Which users can view workflow information they are not authorized to access?
Any member account could retrieve all active workflow IDs through the affected endpoint, regardless of workflow sharing. Every connected client could also receive workflow IDs, version IDs, and activation-error details through workflow lifecycle push events.
What configurations are affected?
Instances with member users are affected when those users should not be able to see all workflows. The issue specifically affects users assigned the global:member role, because the endpoint and push events were not scoped through the sharing service.
What should administrators do if they cannot upgrade immediately?
Restrict access to the n8n instance to fully trusted users and avoid creating global:member accounts for untrusted users. These measures are temporary only and do not fully remediate the exposure.
Which versions contain the fix?
Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2, or any later version.