n8n, a popular open-source platform for automating workflows, recently identified a significant security flaw. This issue allows an attacker to bypass intended access restrictions within the OAuth system, potentially leading to unauthorized access to workflows. Specifically, an OAuth client that was approved for one workflow could exploit a weakness to gain access to other unapproved workflows that are accessible to the consenting user. This problem arose because the system did not properly link the refresh token to the original resource it was granted access for, creating a loophole for unintended access.
CVE Details
Product: n8n
Published: September 8, 2026
Severity: HIGH
Status: Analyzed
Affected Products
This vulnerability impacts `n8n` versions prior to `2.37.7` and `2.38.1`. If you are currently running an older version of `n8n` in your environment, your system is potentially at risk from this security flaw.
Current Status
The vulnerability identified as `CVE-2026-86073` has been `Analyzed`. This means security experts have thoroughly investigated and understood the nature and implications of the vulnerability.
Severity Level
The severity of this particular vulnerability is rated as `HIGH`. A high severity rating indicates that the flaw poses a significant risk. If exploited, it could lead to serious consequences, such as unauthorized access to your sensitive workflows and data. Prompt action is strongly recommended to mitigate this risk.
Possible Solutions
Fortunately, the developers behind `n8n` have already addressed this vulnerability and released patches. To ensure the security of your `n8n` instance and protect your workflows from potential exploitation, it is crucial to update your software immediately. The fix correctly binds the refresh token to the original consented resource, effectively closing the security loophole.
- Upgrade to n8n 2.37.7 or later: This version includes the necessary security fix.
- Upgrade to n8n 2.38.1 or later: This version also addresses the vulnerability.
References
https://github.com/n8n-io/n8n/commit/18458482861097a26f874f30ad7e8136e268475c
https://github.com/n8n-io/n8n/commit/380788fd9a3264c83161e868026a98731d274d88
https://github.com/n8n-io/n8n/pull/37122
https://github.com/n8n-io/n8n/pull/37588
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.1
https://github.com/n8n-io/n8n/security/advisories/GHSA-cw9w-vv67-hf73
