CVE-2026-86079

MediumCVSS 6.5/10Last modified Sep 11, 2026

Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-22

Affected software

Vendor	Product	Versions
n8n-io	n8n	>= 2.38.0, < 2.38.2; >= 2.0.0, < 2.37.7; < 1.123.76

References

https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76Release Notes
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7Release Notes
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2Release Notes
https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cp-m7mv-8jpvMitigation, Vendor Advisory

Timeline

Published: Sep 8, 2026
Last modified: Sep 11, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-86085.3The Event Monster – Event Management, Events Calendar, Tickets plugin for WordPress is vulnerable to Insufficient Verification of Data Authe CVE-2026-860805.3n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but CVE-2026-860817.1n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Git node clone operation matched an attacker-CVE-2026-860826.5n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the OpenAI Chat Model node enforced credential al CVE-2026-860838.8n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the legacy expression engine generated source tex CVE-2026-860845.5n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the public OIDC login and callback endpoints comp CVE-2026-860854.9n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assi CVE-2026-860874.3IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow an authenticated user to send a specially crafted request to write arbi CVE-2026-860897.1Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list e CVE-2026-86097.5An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eve CVE-2026-860907.1ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-ad CVE-2026-860917.1ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to dele