Information Disclosure in n8n Workflow Automation Platform
CVE-2026-86994
5.3MEDIUM
What is CVE-2026-86994?
The n8n workflow automation platform has a vulnerability where the /rest/active-workflows endpoint exposed all active workflow IDs to any user, regardless of their permissions. This flaw allowed unauthorized users to view sensitive information such as workflow IDs, version IDs, and details about activation errors. Additionally, events related to workflow activation and deactivation were visible to clients who should not have access to such data. This issue has been addressed in versions 1.123.76, 2.37.7, and 2.38.2.
Affected Version(s)
n8n >= 2.38.0, < 2.38.2 < 2.38.0, 2.38.2
n8n >= 2.0.0, < 2.37.7 < 2.0.0, 2.37.7
n8n < 1.123.76 < 1.123.76