CVE-2026-65014: n8n Authentication Bypass Vulnerability

CVE-2026-65014 Overview

CVE-2026-65014 is an authentication bypass vulnerability in n8n, the open-source workflow automation platform. The flaw exists in versions before 2.28.0 and before 2.27.4 on the 2.27.x branch. n8n registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied. Any unauthenticated network caller who knows a workflow ID can cancel that workflow's active test webhook registration. The vulnerability is tracked as [CWE-306: Missing Authentication for Critical Function].

Critical Impact
Unauthenticated attackers can disrupt in-progress test webhook sessions by canceling registrations remotely. Production webhooks, persistent workflow state, and stored data remain unaffected.

Affected Products

n8n versions before 2.28.0
n8n 2.27.x branch versions before 2.27.4
Self-hosted n8n deployments exposing the REST endpoint to untrusted networks

Discovery Timeline

2026-07-22 - CVE-2026-65014 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65014

Vulnerability Analysis

n8n exposes a REST endpoint used to manage test webhook registrations during workflow development. The DELETE /${restEndpoint}/test-webhook/:id route is registered on the Express router before the authentication middleware is applied. As a result, the middleware never evaluates requests to this route, and no session or API key is required. The endpoint accepts a workflow ID in the URL path and removes the corresponding active test webhook registration.

The scope of impact is bounded. Only active, in-progress test webhook sessions can be canceled. Production webhooks continue to function, workflow definitions are not modified, and persisted data is not accessed or altered. Developers relying on the test webhook interface for interactive workflow debugging may see their sessions terminated repeatedly if an attacker enumerates or guesses workflow IDs.

Root Cause

The root cause is middleware ordering in the Express route registration. Authentication guards are appended after the test-webhook DELETE handler is bound, leaving the handler exposed on the same network interface as authenticated endpoints. This aligns with [CWE-306], where a critical state-changing operation lacks any authentication check.

Attack Vector

Exploitation requires network reachability to the n8n REST interface and knowledge or guess of a valid workflow ID. Workflow IDs are typically short identifiers that may be enumerable in some deployments. An attacker sends an unauthenticated HTTP DELETE request to the test-webhook/:id path. The server processes the deletion and unregisters the active test webhook without validating the caller's identity.

No verified public exploit code is available. Refer to the GitHub Security Advisory GHSA-33q9-f52j-gc75 and the VulnCheck Advisory for the maintainer's technical description.

Detection Methods for CVE-2026-65014

Indicators of Compromise

Unauthenticated HTTP DELETE requests to paths matching /rest/test-webhook/* or the configured restEndpoint prefix
Repeated DELETE requests iterating across sequential or randomized workflow ID values, indicating enumeration
Developer reports of test webhook sessions terminating unexpectedly during workflow debugging

Detection Strategies

Inspect n8n application logs and reverse proxy access logs for DELETE requests to test-webhook routes lacking associated authenticated session cookies or Authorization headers
Alert on any request to test-webhook/:id returning a 2xx status without a preceding authenticated request from the same source in the session window
Correlate deletion events with workflow owner activity to identify cancellations that did not originate from the workflow's owner

Monitoring Recommendations

Forward n8n and upstream proxy logs to a centralized logging platform for query and long-term retention
Build a dashboard tracking request volume to the test-webhook route grouped by source IP and authentication state
Monitor for external IP addresses accessing the n8n REST endpoint if the instance is intended to be internal only

How to Mitigate CVE-2026-65014

Immediate Actions Required

Upgrade n8n to version 2.28.0 or later, or to 2.27.4 if remaining on the 2.27.x branch
Restrict network exposure of the n8n REST interface to trusted developer networks or VPN segments
Audit reverse proxy or ingress rules to confirm the n8n management interface is not reachable from the public internet

Patch Information

The maintainers fixed the issue by reordering middleware registration so authentication is enforced before the DELETE /test-webhook/:id handler is reached. Upgrade to n8n 2.28.0 or 2.27.4. See the GitHub Security Advisory GHSA-33q9-f52j-gc75 for release details.

Workarounds

Block unauthenticated access to /rest/test-webhook/* at the reverse proxy or Web Application Firewall until the upgrade is applied
Place the n8n instance behind an authenticating proxy such as an SSO gateway that requires user authentication for all HTTP methods including DELETE
Limit access to the n8n host to internal IP ranges using host firewall or cloud security group rules

bash

# Example nginx rule to require authentication on test-webhook DELETE requests
location ~ ^/rest/test-webhook/ {
    limit_except GET POST {
        auth_request /_auth;
    }
    proxy_pass http://n8n_upstream;
}