EUVD-2026-339290

fkie_cve-2026-65014

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.

GHSA-33q9-f52j-gc75 — n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

Affected: npm: n8n

## Impact The `DELETE /${restEndpoint}/test-webhook/:id` route is registered before the authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration.

The impact is limited to disrupting in-progress test sessions. Production webhooks, persistent workflow state, and stored data are not affected.

## Patches Users should upgrade to the patched version once available to remediate the vulnerability.

## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict network access to the n8n instance to fully trusted users only. - Place the n8n instance behind a reverse proxy or firewall that requires authentication before reaching the REST API.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Most recent entries from all

EUVD-2026-339290

fkie_cve-2026-65014

GHSA-33q9-f52j-gc75 — n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook