CVE-2026-110852

— UNSCOREDpublic exploit available

Published 2026-10-14 · Updated 2026-10-15

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.

Weaknesses

CWE-288

Public exploit & PoC references

https://github.com/n8n-io/n8n/security/advisories/GHSA-4c7j-qff5-r9cx

All references

https://github.com/n8n-io/n8n/security/advisories/GHSA-4c7j-qff5-r9cx
https://www.vulncheck.com/advisories/n8n-before-1.123.83-2.41.4-and-2.42.1-unauthenticated-workflow-execution-via-dynamic-path-webhook-resolution

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100261
MEDIUMCVE-2026-100518
CRITICALCVE-2026-104075
MEDIUMCVE-2026-106601
MEDIUMCVE-2026-106602
UNSCOREDCVE-2026-107194
MEDIUMCVE-2026-107361PoC
CRITICALCVE-2026-110130PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.