CVE-2026-59253 Overview
CVE-2026-59253 is an improper authorization vulnerability [CWE-639] affecting n8n workflow automation platform versions prior to 2.28.0. Authenticated users can assign workflows to folders belonging to other projects by supplying crafted request payloads during workflow creation. The flaw bypasses project and folder authorization boundaries, causing logical integrity violations in target project folder structures. The vulnerability requires low-privilege authenticated access and network reachability to the n8n instance. Successful exploitation does not disclose data or cause denial of service, but it undermines multi-tenant workflow segregation and integrity controls.
Critical Impact
Authenticated attackers can violate project isolation boundaries in n8n, corrupting folder structures across tenant projects they should not access.
Affected Products
- n8n versions prior to 2.28.0
- Self-hosted n8n Node.js deployments
- Multi-tenant n8n environments with project and folder separation
Discovery Timeline
- 2026-07-08 - CVE-2026-59253 published to NVD
- 2026-07-08 - Last updated in NVD database
Technical Details for CVE-2026-59253
Vulnerability Analysis
n8n implements a project-based access control model where workflows belong to projects and can be organized into folders within those projects. The workflow creation endpoint accepts a folder assignment parameter as part of the request payload. In versions before 2.28.0, the server validates that the caller has permission to create workflows but fails to verify that the specified target folder belongs to a project the caller can access.
An authenticated user with permission to create workflows in one project can supply a folderId referencing a folder in an unrelated project. The backend persists the assignment without cross-checking the folder's parent project against the caller's authorization scope. This produces workflows appearing in folders that belong to projects the attacker has no legitimate access to.
Root Cause
The root cause is missing authorization on a user-controlled object reference, matching the [CWE-639] pattern of Authorization Bypass Through User-Controlled Key. The workflow assignment logic trusts the client-supplied folder identifier without confirming that the folder resides within a project the requesting user is entitled to modify.
Attack Vector
Exploitation requires network access to the n8n API and a valid authenticated session with at least workflow creation privileges. The attacker enumerates or guesses folder identifiers belonging to other projects, then issues a workflow creation request with the crafted folderId value. No user interaction is required on the victim side. The vulnerability is described in the n8n GitHub Security Advisory GHSA-2xgm-wc4g-5jvg and the VulnCheck Advisory.
Detection Methods for CVE-2026-59253
Indicators of Compromise
- Workflow creation API calls containing folderId values that do not correspond to any folder in the caller's authorized projects
- Unexpected workflows appearing inside folders owned by projects the creator is not a member of
- Audit log entries showing workflow ownership or folder assignment changes that cross project boundaries
Detection Strategies
- Review n8n application logs for POST /rest/workflows and workflow update requests that include folder identifiers, correlating the caller's project membership with the target folder's parent project
- Query the database for workflows whose parentFolderId resolves to a project different from the workflow owner's assigned projects
- Alert on any workflow creation event where the requesting user lacks membership in the resolved target project
Monitoring Recommendations
- Enable verbose audit logging on the n8n API layer and forward events to a centralized log store for retention and correlation
- Baseline normal folder assignment patterns per user and project, then flag deviations that cross tenant boundaries
- Monitor the n8n version string exposed by administrative endpoints to confirm all instances are running 2.28.0 or later
How to Mitigate CVE-2026-59253
Immediate Actions Required
- Upgrade all n8n deployments to version 2.28.0 or later, which enforces cross-project folder authorization checks
- Audit existing workflow-to-folder mappings and remediate any assignments that cross project boundaries
- Review project membership lists and revoke workflow creation privileges from accounts that do not require them
Patch Information
n8n released a fix in version 2.28.0 that validates the target folder's parent project against the caller's authorization scope during workflow creation and update operations. Refer to the n8n GitHub Security Advisory GHSA-2xgm-wc4g-5jvg for the official remediation guidance and affected version details.
Workarounds
- Restrict workflow creation permissions to trusted users until the upgrade to 2.28.0 is completed
- Place the n8n API behind an authenticating reverse proxy that can enforce additional payload validation on workflow endpoints
- Segment tenants into separate n8n instances where strict project isolation is a hard security requirement
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
