Uncovering the n8n Information Disclosure Vulnerability
A notable security flaw has been identified in n8n, an open-source platform designed for workflow automation. This vulnerability, tracked as CVE-2026-86085, could have allowed unauthorized individuals to access sensitive information belonging to project members, specifically their names and email addresses. This kind of data exposure can lead to privacy concerns and potentially further malicious activities.
CVE Details
The vulnerability impacts specific versions of the n8n platform. Here are the key details:
- Product: n8n (Node.js)
- Published Date: September 8, 2026
- Severity: Medium
- Status: Analyzed
This issue stemmed from a missing security check in two specific API endpoints: /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members. These endpoints only verified if a user could manage a role type. However, a user with the role:manageProject permission could exploit this by naming a project they were not authorized to list. This bypass allowed them to uncover member names and email addresses associated with that project, even without proper listing permissions.
Affected Products
The information disclosure vulnerability affects n8n versions prior to:
- n8n 2.37.7
- n8n 2.38.2
If you are running any version older than 2.37.7 or 2.38.2, your system is at risk.
Current Status
This vulnerability has been thoroughly analyzed, and fixes have been released by the n8n team. It is important for all users to update their installations to a secure version as soon as possible.
Severity Level
Rated as Medium severity, this vulnerability poses a moderate risk. While it doesn’t allow for full system control, the unauthorized disclosure of user data like names and email addresses is a significant privacy breach. Such information can be misused for phishing attacks, spam, or other social engineering tactics, making a timely patch crucial.
Possible Solutions
The good news is that the n8n team has already provided solutions to address this vulnerability. To protect your n8n instance from CVE-2026-86085, you must update to a patched version.
- Upgrade to n8n version 2.37.7 or later.
- Upgrade to n8n version 2.38.2 or later.
Always ensure your software is up-to-date to benefit from the latest security fixes and improvements.
References
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
https://github.com/n8n-io/n8n/security/advisories/GHSA-cqr2-h44g-v75v
