A security vulnerability has been identified in n8n, an open-source platform for automating workflows. This flaw, tracked as CVE-2026-86079, could allow an attacker to gain unauthorized access to certain parts of your Elasticsearch or ElasticSecurity setup when n8n is configured to interact with them.<\/p>\n
In simple terms, n8n’s Elasticsearch and ElasticSecurity nodes were not properly handling how they created paths for their requests. If a malicious input containing special characters like “..” (dot-dot) or path separators was used as an index or document identifier in a workflow, it could trick the system. This misinterpretation could lead to the workflow gaining access to unintended data indices or even some cluster administration functions, all under the existing Elasticsearch credentials stored within n8n.<\/p>\n
The core of the problem lies in how n8n constructs these request paths, specifically in the The n8n workflow automation platform is affected by this vulnerability. Specifically, all versions of n8n prior to the following releases are vulnerable:<\/p>\n This vulnerability has been officially analyzed. This means that the details of the flaw are understood, and its impact has been assessed.<\/p>\n The severity level for CVE-2026-86079 is rated as Medium<\/strong>. A medium severity rating indicates that while the vulnerability could be exploited, it might require specific conditions or user interaction, or the impact might be limited compared to critical flaws. However, it still poses a significant risk as it could lead to unauthorized data access or control over parts of your Elasticsearch environment if exploited.<\/p>\n The good news is that n8n has already released patches to address this vulnerability. To protect your n8n installations and integrated Elasticsearch\/ElasticSecurity nodes, it is crucial to update to one of the fixed versions immediately:<\/p>\n Always ensure your software is up-to-date to benefit from the latest security enhancements. For a deeper understanding of similar issues, you might find our article on “Understanding Path Traversal Vulnerabilities” helpful.<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/releases\/tag\/n8n@1.123.76<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/releases\/tag\/n8n@2.37.7<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/releases\/tag\/n8n@2.38.2<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/security\/advisories\/GHSA-f2cp-m7mv-8jpv<\/p>\n","protected":false},"excerpt":{"rendered":" A security vulnerability has been identified in n8n, an open-source platform for automating workflows. This flaw, tracked as CVE-2026-86079, could allow an attacker to gain unauthorized access to certain parts of your Elasticsearch or ElasticSecurity setup when n8n is configured to interact with them. In simple terms, n8n’s Elasticsearch and ElasticSecurity nodes were not properly […]<\/p>\n","protected":false},"author":17,"featured_media":3515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[732,1240,1067,971,1068],"class_list":["post-3985","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-cybersecurity","tag-elasticsearch-security","tag-n8n","tag-path-traversal","tag-workflow-automation"],"blocksy_meta":[],"yoast_head":"\npackages\/nodes-base\/nodes\/Elastic\/Elasticsearch\/GenericFunctions.ts<\/code> file, where important path encoding was overlooked. This oversight allowed for the path traversal issue to occur.<\/p>\nCVE Details<\/h2>\n
\n
Affected Products<\/h2>\n
\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
References<\/h2>\n