CVE-2026-92588: Authorization Bypass Through User-Controlled Key in n8n-io n8n
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting user. An authenticated project-scoped user (e.g., a project admin) could therefore reference files belonging to projects they have no access to and push a deletion of those projects' workflows and credentials, resulting in cross-project data destruction. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. The issue is fixed in 1.123.76, 2.37.7, and 2.38.2.
AI Analysis
Technical Summary
In n8n versions prior to 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint trusts client-supplied file paths and statuses instead of using server-side computed status for the requesting user. This allows an authenticated project-scoped user, such as a project admin, to reference and delete workflows and credentials belonging to other projects they do not have access to, resulting in cross-project data destruction. The vulnerability requires the enterprise Source Control (Environments) feature to be active and connected to a remote repository. The vendor has fixed this issue in versions 1.123.76, 2.37.7, and 2.38.2.
Potential Impact
An authenticated user with project-scoped permissions can delete workflows and credentials from projects they are unauthorized to access, causing cross-project data destruction. This compromises data integrity and availability within the n8n platform for affected installations with the Source Control enterprise feature enabled.
Mitigation Recommendations
A fix is available in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to these or later versions to remediate the vulnerability. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository, so disabling or restricting this feature may reduce risk until patching is applied.
CVE-2026-92588: Authorization Bypass Through User-Controlled Key in n8n-io n8n
Description
n8n is a workflow automation platform. In n8n versions before 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint derived the set of files to push from the file paths and status supplied in the client request payload instead of from the server-side status computed for the requesting user. An authenticated project-scoped user (e.g., a project admin) could therefore reference files belonging to projects they have no access to and push a deletion of those projects' workflows and credentials, resulting in cross-project data destruction. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository. The issue is fixed in 1.123.76, 2.37.7, and 2.38.2.
CVSS v4.0
Score 5.9medium
Affected software
n8n-io
n8n
n8n-io
n8n
n8n-io
n8n
pkg:github/n8n-io/n8nRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In n8n versions prior to 1.123.76, 2.37.7, and 2.38.2, the source control push endpoint trusts client-supplied file paths and statuses instead of using server-side computed status for the requesting user. This allows an authenticated project-scoped user, such as a project admin, to reference and delete workflows and credentials belonging to other projects they do not have access to, resulting in cross-project data destruction. The vulnerability requires the enterprise Source Control (Environments) feature to be active and connected to a remote repository. The vendor has fixed this issue in versions 1.123.76, 2.37.7, and 2.38.2.
Potential Impact
An authenticated user with project-scoped permissions can delete workflows and credentials from projects they are unauthorized to access, causing cross-project data destruction. This compromises data integrity and availability within the n8n platform for affected installations with the Source Control enterprise feature enabled.
Mitigation Recommendations
A fix is available in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to these or later versions to remediate the vulnerability. Exploitation requires the Source Control (Environments) enterprise feature to be licensed, enabled, and connected to a remote repository, so disabling or restricting this feature may reduce risk until patching is applied.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-09-16T13:47:49.170Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6aab120655bf5e2cf536882e
Added to database: 09/16/2026, 22:02:46 UTC
Last enriched: 09/16/2026, 23:13:31 UTC
Last updated: 09/17/2026, 03:04:11 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.