Authorization Bypass in n8n Agents Endpoint

CVE-2026-110851

What is CVE-2026-110851?

n8n versions prior to 2.41.4 and 2.42.x versions before 2.42.1 are susceptible to an authorization bypass in the Agents create endpoint. This vulnerability allows an authenticated user with read-only access to modify Agent details from another project. Affected users can exploit this flaw by providing an existing Agent ID during the creation process, thereby gaining unauthorized control over the Agent including its name, schema, and version, which could lead to further security implications across projects.

References