Unintended Access to Project Data in n8n
A security flaw has been found in n8n, a workflow automation tool, that could allow unauthorized access to sensitive project details. This vulnerability, identified as CVE-2026-85173, affects the Insights API routes within n8n. Simply put, an authenticated user with certain permissions could view workflow names and execution statistics from projects they were not supposed to have access to. This means that even if a user was assigned a restricted role, they could still potentially peek into the activities of other projects by supplying a fake project ID.
While no actual secret credentials or workflow content were exposed, the names of workflows and projects often reveal important information about their purpose or the teams and clients they serve. This unintended information disclosure poses a risk to privacy and operational security for organizations using n8n.
CVE Details
- Product: n8n
- Published: September 3, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability impacts versions of n8n before 2.36.2 and also versions before 2.35.4. This includes any n8n instance running an earlier release where the Insights API is accessible to authenticated users with the relevant scope.
Current Status
The vulnerability has been thoroughly analyzed, and patches have been released to address the issue. It is crucial for users to update their n8n instances promptly to safeguard their project data.
Severity Level
This vulnerability is rated as Medium Severity with a CVSS score of 4.3. A medium severity rating indicates that exploiting this flaw could lead to unauthorized information disclosure, impacting the confidentiality of non-critical data. While direct control over the system or manipulation of data is not possible through this specific vulnerability, the exposure of internal project structures and operational insights could still be misused.
Possible Solutions
To protect your n8n instance from this vulnerability, the primary recommendation is to update your software:
- Upgrade your n8n instance to version 2.36.2 or later.
- Alternatively, if you are on the 2.35.x branch, upgrade to version 2.35.4 or later.
For those who cannot immediately upgrade, here are some temporary mitigation steps:
- Restrict Instance Access: Limit who can access your n8n instance to only fully trusted users.
- Audit and Revoke Roles: Review and remove any custom global roles that include the
insights:listorinsights:readpermissions. Ensure these specific scopes are granted only to users who absolutely need them and are fully trusted.
Please remember that these workarounds are not complete fixes and should only be used as a short-term measure until you can apply the official patches.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-jmmj-93rg-6j39
https://www.vulncheck.com/advisories/n8n-before-2.36.2-missing-authorization-via-insights-api
