CVE-2026-86079 Overview
CVE-2026-86079 affects n8n, an open source workflow automation platform. The vulnerability exists in the Elasticsearch and ElasticSecurity nodes, which interpolate workflow-controlled index and document identifiers directly into REST request paths. An attacker with permission to configure workflows can supply identifiers containing path separators or dot segments to reach unintended indices or cluster administration endpoints using the stored Elasticsearch credential. The flaw is classified under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory). Maintainers fixed the issue in versions 1.123.76, 2.37.7, and 2.38.2.
Critical Impact
Authenticated workflow users can pivot from configured Elasticsearch operations to arbitrary indices and cluster administration APIs under the stored credential, breaking the security scope of the connection.
Affected Products
- n8n versions prior to 1.123.76
- n8n versions prior to 2.37.7
- n8n versions prior to 2.38.2 (Elasticsearch and ElasticSecurity nodes)
Discovery Timeline
- 2026-09-08 - CVE-2026-86079 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86079
Vulnerability Analysis
The Elasticsearch and ElasticSecurity nodes in n8n construct REST request paths by concatenating user-controlled identifier fields into URL templates. The affected code path lives in packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts, which does not apply a toPathSegment encoding step before assembling the final URL.
Because the identifier is inserted raw, characters such as / and .. traverse outside the intended index or document scope. An attacker submits an identifier like ../_cluster/health or index2/_doc/1, and the underlying HTTP client sends the request to a different path on the Elasticsearch cluster. All requests continue to use the credential stored in the node configuration.
The vulnerability is authenticated and requires workflow-editing privileges within n8n. However, the confidentiality and integrity impact reaches beyond the n8n instance itself, because the flaw grants access to cluster resources scoped to the connected Elasticsearch credential.
Root Cause
The root cause is missing path-segment encoding when workflow-controlled identifiers are placed into REST URL templates. The fix introduces a toPathSegment helper that percent-encodes reserved characters, ensuring identifiers cannot escape their expected URL position.
Attack Vector
Exploitation occurs over the network through the n8n web interface or API. An authenticated user with workflow-editing rights configures an Elasticsearch or ElasticSecurity node with a crafted index or document identifier. When the workflow runs, n8n issues a REST call using the manipulated path, and Elasticsearch resolves the request against a different index or administrative endpoint. No verified public proof-of-concept exploit is available at time of writing. Refer to the GitHub Security Advisory GHSA-f2cp-m7mv-8jpv for the maintainer's technical description.
Detection Methods for CVE-2026-86079
Indicators of Compromise
- Elasticsearch access logs showing requests to _cluster/*, _cat/*, _nodes/*, or _security/* endpoints originating from the n8n service account.
- Requests where index names contain URL-encoded or literal .., /, or reserved path characters.
- Unexpected access from n8n to indices that are not referenced in any configured workflow.
Detection Strategies
- Audit workflow JSON exports for Elasticsearch or ElasticSecurity nodes containing identifier fields with /, .., or encoded path separators.
- Correlate n8n workflow execution logs with Elasticsearch REST access logs to identify identifier values that resolved to unexpected paths.
- Compare the running n8n version against fixed versions 1.123.76, 2.37.7, and 2.38.2 using package inventory tools.
Monitoring Recommendations
- Forward Elasticsearch REST audit logs to a centralized log platform and alert on administrative endpoint access from application service accounts.
- Monitor n8n workflow creation and modification events for changes to Elasticsearch node parameters.
- Alert on Elasticsearch responses referencing index names or endpoints outside a defined allowlist for the n8n credential.
How to Mitigate CVE-2026-86079
Immediate Actions Required
- Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2, matching the release branch in use.
- Rotate any Elasticsearch credentials stored in n8n that may have been used by an untrusted workflow author.
- Review existing workflows for Elasticsearch and ElasticSecurity nodes containing suspicious identifier values.
Patch Information
The issue is fixed in n8n releases 1.123.76, 2.37.7, and 2.38.2. The patch adds a toPathSegment encoding step in packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts so identifiers cannot break out of their intended URL segment.
Workarounds
- Restrict n8n workflow-editing permissions to trusted users until the upgrade is applied.
- Scope stored Elasticsearch credentials to a role with least privilege, limited to the specific indices required by workflows.
- Place Elasticsearch behind a reverse proxy that rejects requests to administrative endpoints (_cluster, _nodes, _security) from the n8n service account.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
