{"id":"CVE-2026-86079","title":"n8n is an open source workflow automation platform","summary":"n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An i…","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22"],"vendor":"n8n","product":"n8n","affected":["n8n < 1.123.76","n8n >= 2.0.0, < 2.37.7","n8n >= 2.38.0, < 2.38.2"],"patched":["n8n 2.38.2"],"published":"2026-09-08","updated":"2026-09-11","sourceUpdated":"2026-09-11T18:21:33.190","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86079","references":[{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cp-m7mv-8jpv","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86079"},{"url":"https://github.com/advisories/GHSA-f2cp-m7mv-8jpv"}],"tags":["nvd","cve.org","ghsa","npm"],"epss":0.00491,"epssPercentile":0.39565,"aliases":["GHSA-f2cp-m7mv-8jpv"],"ecosystem":"npm","ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T15:13:23.976715Z"},"scores":{"nvd":6.5,"cna":6.3},"ingestedAt":"2026-09-08T22:12:31.038Z","slug":"CVE-2026-86079","body":"## Overview\n\nn8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.\n\n## Affected\n\n- `n8n < 1.123.76`\n- `n8n >= 2.0.0, < 2.37.7`\n- `n8n >= 2.38.0, < 2.38.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `n8n 2.38.2`\n\n## Package advisory (CVE-2026-86079)\n\nAffected packages:\n\n- `n8n < 1.123.76`\n- `n8n >= 2.38.0, < 2.38.2`\n- `n8n >= 2.0.0, < 2.37.7`\n\nPatched in:\n\n- `n8n 1.123.76`\n- `n8n 2.38.2`\n- `n8n 2.37.7`\n\nSource: https://github.com/advisories/GHSA-f2cp-m7mv-8jpv","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":202069,"id":"CVE-2026-86079","ts":1789400047497,"field":"cvss","old":"6.3","new":"6.5"},{"seq":200796,"id":"CVE-2026-86079","ts":1789397615780,"field":"cvss","old":"6.5","new":"6.3"},{"seq":199489,"id":"CVE-2026-86079","ts":1789395520958,"field":"cvss","old":"6.3","new":"6.5"},{"seq":198734,"id":"CVE-2026-86079","ts":1789392243386,"field":"cvss","old":"6.5","new":"6.3"},{"seq":197067,"id":"CVE-2026-86079","ts":1789384291790,"field":"cvss","old":"6.3","new":"6.5"},{"seq":194196,"id":"CVE-2026-86079","ts":1789378782447,"field":"cvss","old":"6.5","new":"6.3"},{"seq":192983,"id":"CVE-2026-86079","ts":1789376514432,"field":"cvss","old":"6.3","new":"6.5"},{"seq":191770,"id":"CVE-2026-86079","ts":1789373630459,"field":"cvss","old":"6.5","new":"6.3"},{"seq":190555,"id":"CVE-2026-86079","ts":1789369474682,"field":"cvss","old":"6.3","new":"6.5"},{"seq":189342,"id":"CVE-2026-86079","ts":1789368408390,"field":"cvss","old":"6.5","new":"6.3"},{"seq":188125,"id":"CVE-2026-86079","ts":1789365230094,"field":"cvss","old":"6.3","new":"6.5"},{"seq":186912,"id":"CVE-2026-86079","ts":1789363470651,"field":"cvss","old":"6.5","new":"6.3"},{"seq":185698,"id":"CVE-2026-86079","ts":1789361228431,"field":"cvss","old":"6.3","new":"6.5"},{"seq":184485,"id":"CVE-2026-86079","ts":1789358363038,"field":"cvss","old":"6.5","new":"6.3"},{"seq":182736,"id":"CVE-2026-86079","ts":1789354316455,"field":"cvss","old":"6.3","new":"6.5"},{"seq":181529,"id":"CVE-2026-86079","ts":1789353317061,"field":"cvss","old":"6.5","new":"6.3"},{"seq":180322,"id":"CVE-2026-86079","ts":1789350284080,"field":"cvss","old":"6.3","new":"6.5"},{"seq":179115,"id":"CVE-2026-86079","ts":1789348292226,"field":"cvss","old":"6.5","new":"6.3"},{"seq":177908,"id":"CVE-2026-86079","ts":1789346369378,"field":"cvss","old":"6.3","new":"6.5"},{"seq":176701,"id":"CVE-2026-86079","ts":1789343183881,"field":"cvss","old":"6.5","new":"6.3"},{"seq":174818,"id":"CVE-2026-86079","ts":1789334875011,"field":"cvss","old":"6.3","new":"6.5"},{"seq":173613,"id":"CVE-2026-86079","ts":1789333686190,"field":"cvss","old":"6.5","new":"6.3"},{"seq":172427,"id":"CVE-2026-86079","ts":1789331092367,"field":"cvss","old":"6.3","new":"6.5"},{"seq":171241,"id":"CVE-2026-86079","ts":1789328780249,"field":"cvss","old":"6.5","new":"6.3"},{"seq":170036,"id":"CVE-2026-86079","ts":1789327196515,"field":"cvss","old":"6.3","new":"6.5"},{"seq":168831,"id":"CVE-2026-86079","ts":1789323839413,"field":"cvss","old":"6.5","new":"6.3"},{"seq":167626,"id":"CVE-2026-86079","ts":1789319701799,"field":"cvss","old":"6.3","new":"6.5"},{"seq":166421,"id":"CVE-2026-86079","ts":1789318775492,"field":"cvss","old":"6.5","new":"6.3"},{"seq":165216,"id":"CVE-2026-86079","ts":1789315789308,"field":"cvss","old":"6.3","new":"6.5"},{"seq":164011,"id":"CVE-2026-86079","ts":1789313633644,"field":"cvss","old":"6.5","new":"6.3"},{"seq":162806,"id":"CVE-2026-86079","ts":1789311902766,"field":"cvss","old":"6.3","new":"6.5"},{"seq":161601,"id":"CVE-2026-86079","ts":1789308732586,"field":"cvss","old":"6.5","new":"6.3"},{"seq":159714,"id":"CVE-2026-86079","ts":1789300469957,"field":"cvss","old":"6.3","new":"6.5"},{"seq":156703,"id":"CVE-2026-86079","ts":1789294755009,"field":"cvss","old":"6.5","new":"6.3"},{"seq":155498,"id":"CVE-2026-86079","ts":1789292967288,"field":"cvss","old":"6.3","new":"6.5"},{"seq":154293,"id":"CVE-2026-86079","ts":1789289796926,"field":"cvss","old":"6.5","new":"6.3"},{"seq":151544,"id":"CVE-2026-86079","ts":1789277629222,"field":"cvss","old":"6.3","new":"6.5"},{"seq":150505,"id":"CVE-2026-86079","ts":1789276245026,"field":"cvss","old":"6.5","new":"6.3"},{"seq":149472,"id":"CVE-2026-86079","ts":1789273824074,"field":"cvss","old":"6.3","new":"6.5"},{"seq":148439,"id":"CVE-2026-86079","ts":1789271348113,"field":"cvss","old":"6.5","new":"6.3"},{"seq":146470,"id":"CVE-2026-86079","ts":1789269393961,"field":"cvss","old":"6.3","new":"6.5"},{"seq":145275,"id":"CVE-2026-86079","ts":1789266338950,"field":"cvss","old":"6.5","new":"6.3"},{"seq":144179,"id":"CVE-2026-86079","ts":1789262616120,"field":"cvss","old":"6.3","new":"6.5"},{"seq":143083,"id":"CVE-2026-86079","ts":1789261532806,"field":"cvss","old":"6.5","new":"6.3"},{"seq":141914,"id":"CVE-2026-86079","ts":1789258831136,"field":"cvss","old":"6.3","new":"6.5"},{"seq":140755,"id":"CVE-2026-86079","ts":1789256726529,"field":"cvss","old":"6.5","new":"6.3"},{"seq":139557,"id":"CVE-2026-86079","ts":1789254831418,"field":"cvss","old":"6.3","new":"6.5"},{"seq":138359,"id":"CVE-2026-86079","ts":1789251933611,"field":"cvss","old":"6.5","new":"6.3"},{"seq":137161,"id":"CVE-2026-86079","ts":1789247832099,"field":"cvss","old":"6.3","new":"6.5"},{"seq":135963,"id":"CVE-2026-86079","ts":1789247055367,"field":"cvss","old":"6.5","new":"6.3"}]}