Authentication Bypass in n8n Webhook Functionality

CVE-2026-110852

What is CVE-2026-110852?

An authentication bypass vulnerability exists in n8n prior to version 1.123.83, as well as 2.x versions prior to 2.41.4 and 2.42.x versions before 2.42.1. This weakness allows unauthenticated attackers to exploit dynamic-path webhook resolution, where requests are matched on the path alone, ignoring the server-generated identifier. As a result, attackers can bypass authentication and send unsolicited requests to webhook, form, or MCP routes, potentially executing workflows in unrelated projects, thereby compromising the security of those projects.

References