PT-2026-63344 · N8N · N8N
CVE-2026-65014
·
Published
2026-07-22
·
Updated
2026-07-22
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
n8n versions prior to 2.28.0
n8n versions prior to 2.27.4
Description
The
DELETE /${restEndpoint}/test-webhook/:id endpoint is registered before authentication middleware is applied. This allows an unauthenticated network caller who knows a workflow ID to cancel the active test webhook registration of that workflow. The impact is limited to the disruption of in-progress test sessions, while production webhooks, persistent workflow state, and stored data remain unaffected.Recommendations
Update to version 2.28.0 or later.
Update to version 2.27.4 or later for the 2.27.x branch.
Restrict network access to the instance to fully trusted users only.
Place the instance behind a reverse proxy or firewall that requires authentication before reaching the REST API.
Exploit
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
N8N