Understanding the n8n Origin Validation Bypass Vulnerability
n8n, a widely used open-source platform for automating workflows, has been identified with a significant security vulnerability, tracked as CVE-2026-86074. This flaw primarily affects the platform’s Instance AI credential setup flow, where it failed to properly verify the origin of certain URLs. This oversight could potentially allow malicious actors to manipulate the system. By injecting attacker-controlled content into the setup flow, an attacker could influence the credential test or verification URL. This manipulation could lead to unauthorized authenticated requests, redirects to malicious sites, or network probes targeting other origins, posing a serious risk to data integrity and system security.
CVE Details
- Product: n8n (workflow automation platform)
- Published Date: September 8, 2026
- Severity: High
- Status: Analyzed
Affected Products
This vulnerability specifically impacts versions of n8n that are older than 2.37.7 and 2.38.2. If you are operating an n8n instance that falls within these earlier versions, your system could be exposed to potential exploits.
Current Status
The security community and the n8n development team have thoroughly analyzed CVE-2026-86074. The vulnerability’s details are clear, and the necessary patches have been developed and released.
Severity Level
CVE-2026-86074 has been assigned a “High” severity rating with a CVSS score of 7.1. A high severity classification means that successful exploitation of this vulnerability could result in substantial unauthorized access, data compromise, or disruption of services. It is crucial for administrators and developers to address this issue promptly to mitigate risks.
Possible Solutions
Fortunately, the n8n team has released updates that fix this critical vulnerability. To secure your n8n instance, it is strongly recommended that you upgrade to version 2.37.7, 2.38.2, or any subsequent releases. Regularly updating your software is a fundamental security practice that helps protect your systems from known vulnerabilities.
References
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
- https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
- https://github.com/n8n-io/n8n/security/advisories/GHSA-q5wm-mgqx-fv2f
