{"id":"CVE-2026-86994","title":"n8n is an open source workflow automation platform","summary":"n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, de…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","cwe":["CWE-862"],"vendor":"n8n","product":"n8n","affected":["n8n < 1.123.76","n8n >= 2.0.0, < 2.37.7","n8n >= 2.38.0, < 2.38.2"],"patched":["n8n 2.38.2"],"published":"2026-09-08","updated":"2026-09-10","sourceUpdated":"2026-09-10T21:01:20.000","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86994","references":[{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2","label":"security-advisories@github.com"},{"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-65xw-2v52-jhxc","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86994"},{"url":"https://github.com/advisories/GHSA-65xw-2v52-jhxc"}],"tags":["nvd","ghsa","npm","cve.org"],"aliases":["GHSA-65xw-2v52-jhxc"],"ecosystem":"npm","epss":0.00199,"epssPercentile":0.10044,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T15:40:03.107101Z"},"scores":{"nvd":4.3,"cna":5.3},"ingestedAt":"2026-09-08T22:12:31.039Z","slug":"CVE-2026-86994","body":"## Overview\n\nn8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details. The affected paths include packages/cli/src/services/active-workflows.service.ts and packages/cli/src/workflows/workflow-push-notifier.service.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.\n\n## Affected\n\n- `n8n < 1.123.76`\n- `n8n >= 2.0.0, < 2.37.7`\n- `n8n >= 2.38.0, < 2.38.2`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `n8n 2.38.2`\n\n## Package advisory (CVE-2026-86994)\n\nAffected packages:\n\n- `n8n < 1.123.76`\n- `n8n >= 2.38.0, < 2.38.2`\n- `n8n >= 2.0.0, < 2.37.7`\n\nPatched in:\n\n- `n8n 1.123.76`\n- `n8n 2.38.2`\n- `n8n 2.37.7`\n\nSource: https://github.com/advisories/GHSA-65xw-2v52-jhxc","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":202159,"id":"CVE-2026-86994","ts":1789400064591,"field":"cvss","old":"5.3","new":"4.3"},{"seq":200886,"id":"CVE-2026-86994","ts":1789397618199,"field":"cvss","old":"4.3","new":"5.3"},{"seq":199579,"id":"CVE-2026-86994","ts":1789395553293,"field":"cvss","old":"5.3","new":"4.3"},{"seq":198824,"id":"CVE-2026-86994","ts":1789392246525,"field":"cvss","old":"4.3","new":"5.3"},{"seq":197157,"id":"CVE-2026-86994","ts":1789384295648,"field":"cvss","old":"5.3","new":"4.3"},{"seq":196431,"id":"CVE-2026-86994","ts":1789383757672,"field":"cvss","old":"4.3","new":"5.3"},{"seq":195335,"id":"CVE-2026-86994","ts":1789380576402,"field":"cvss","old":"5.3","new":"4.3"},{"seq":194286,"id":"CVE-2026-86994","ts":1789378784847,"field":"cvss","old":"4.3","new":"5.3"},{"seq":193073,"id":"CVE-2026-86994","ts":1789376519548,"field":"cvss","old":"5.3","new":"4.3"},{"seq":191860,"id":"CVE-2026-86994","ts":1789373633096,"field":"cvss","old":"4.3","new":"5.3"},{"seq":190645,"id":"CVE-2026-86994","ts":1789369486024,"field":"cvss","old":"5.3","new":"4.3"},{"seq":189432,"id":"CVE-2026-86994","ts":1789368448023,"field":"cvss","old":"4.3","new":"5.3"},{"seq":188215,"id":"CVE-2026-86994","ts":1789365235525,"field":"cvss","old":"5.3","new":"4.3"},{"seq":187002,"id":"CVE-2026-86994","ts":1789363472928,"field":"cvss","old":"4.3","new":"5.3"},{"seq":185788,"id":"CVE-2026-86994","ts":1789361234159,"field":"cvss","old":"5.3","new":"4.3"},{"seq":184575,"id":"CVE-2026-86994","ts":1789358365666,"field":"cvss","old":"4.3","new":"5.3"},{"seq":182825,"id":"CVE-2026-86994","ts":1789354321850,"field":"cvss","old":"5.3","new":"4.3"},{"seq":181618,"id":"CVE-2026-86994","ts":1789353322672,"field":"cvss","old":"4.3","new":"5.3"},{"seq":180411,"id":"CVE-2026-86994","ts":1789350289473,"field":"cvss","old":"5.3","new":"4.3"},{"seq":179204,"id":"CVE-2026-86994","ts":1789348294575,"field":"cvss","old":"4.3","new":"5.3"},{"seq":177997,"id":"CVE-2026-86994","ts":1789346376537,"field":"cvss","old":"5.3","new":"4.3"},{"seq":176790,"id":"CVE-2026-86994","ts":1789343186257,"field":"cvss","old":"4.3","new":"5.3"},{"seq":174907,"id":"CVE-2026-86994","ts":1789334883010,"field":"cvss","old":"5.3","new":"4.3"},{"seq":173702,"id":"CVE-2026-86994","ts":1789333702451,"field":"cvss","old":"4.3","new":"5.3"},{"seq":172516,"id":"CVE-2026-86994","ts":1789331095515,"field":"cvss","old":"5.3","new":"4.3"},{"seq":171330,"id":"CVE-2026-86994","ts":1789328782534,"field":"cvss","old":"4.3","new":"5.3"},{"seq":170125,"id":"CVE-2026-86994","ts":1789327203199,"field":"cvss","old":"5.3","new":"4.3"},{"seq":168920,"id":"CVE-2026-86994","ts":1789323842459,"field":"cvss","old":"4.3","new":"5.3"},{"seq":167715,"id":"CVE-2026-86994","ts":1789319705678,"field":"cvss","old":"5.3","new":"4.3"},{"seq":166510,"id":"CVE-2026-86994","ts":1789318777829,"field":"cvss","old":"4.3","new":"5.3"},{"seq":165305,"id":"CVE-2026-86994","ts":1789315813318,"field":"cvss","old":"5.3","new":"4.3"},{"seq":164100,"id":"CVE-2026-86994","ts":1789313635959,"field":"cvss","old":"4.3","new":"5.3"},{"seq":162895,"id":"CVE-2026-86994","ts":1789311910489,"field":"cvss","old":"5.3","new":"4.3"},{"seq":161690,"id":"CVE-2026-86994","ts":1789308734824,"field":"cvss","old":"4.3","new":"5.3"},{"seq":159803,"id":"CVE-2026-86994","ts":1789300473071,"field":"cvss","old":"5.3","new":"4.3"},{"seq":158864,"id":"CVE-2026-86994","ts":1789299572254,"field":"cvss","old":"4.3","new":"5.3"},{"seq":157790,"id":"CVE-2026-86994","ts":1789296629003,"field":"cvss","old":"5.3","new":"4.3"},{"seq":156792,"id":"CVE-2026-86994","ts":1789294758573,"field":"cvss","old":"4.3","new":"5.3"},{"seq":155587,"id":"CVE-2026-86994","ts":1789292971656,"field":"cvss","old":"5.3","new":"4.3"},{"seq":154382,"id":"CVE-2026-86994","ts":1789289803242,"field":"cvss","old":"4.3","new":"5.3"},{"seq":151633,"id":"CVE-2026-86994","ts":1789277632248,"field":"cvss","old":"5.3","new":"4.3"},{"seq":150594,"id":"CVE-2026-86994","ts":1789276255725,"field":"cvss","old":"4.3","new":"5.3"},{"seq":149561,"id":"CVE-2026-86994","ts":1789273827650,"field":"cvss","old":"5.3","new":"4.3"},{"seq":148528,"id":"CVE-2026-86994","ts":1789271351815,"field":"cvss","old":"4.3","new":"5.3"},{"seq":146559,"id":"CVE-2026-86994","ts":1789269401161,"field":"cvss","old":"5.3","new":"4.3"},{"seq":145364,"id":"CVE-2026-86994","ts":1789266341899,"field":"cvss","old":"4.3","new":"5.3"},{"seq":144268,"id":"CVE-2026-86994","ts":1789262620353,"field":"cvss","old":"5.3","new":"4.3"},{"seq":143172,"id":"CVE-2026-86994","ts":1789261536037,"field":"cvss","old":"4.3","new":"5.3"},{"seq":142003,"id":"CVE-2026-86994","ts":1789258846606,"field":"cvss","old":"5.3","new":"4.3"},{"seq":140844,"id":"CVE-2026-86994","ts":1789256728753,"field":"cvss","old":"4.3","new":"5.3"}]}