Improper Authorization in n8n Workflow Automation Platform

CVE-2026-92588

What is CVE-2026-92588?

The n8n workflow automation platform has a significant vulnerability impacting versions prior to 1.123.76, 2.37.7, and 2.38.2. This flaw arises from the source control push endpoint improperly using client request payload data to determine which files can be pushed. Consequently, an authenticated user with project-scoped access can manipulate files from projects they do not have authorization to access, potentially deleting workflows and credentials across multiple projects. Exploiting this vulnerability necessitates enabling the Source Control (Environments) enterprise feature and connecting to a remote repository, emphasizing the importance of upgrading to the latest versions to mitigate risks.

References