CVE-2026-86085: n8n Workflow Automation Auth Bypass Flaw

CVE-2026-86085 Overview

CVE-2026-86085 is a missing authorization vulnerability [CWE-862] in n8n, an open source workflow automation platform. The flaw affects versions prior to 2.37.7 and 2.38.2. The /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints only verified whether the caller could manage the role type. They omitted a project:list scope check. A caller holding role:manageProject could name a project they were not entitled to list and retrieve member names and email addresses. The vendor patched the issue in versions 2.37.7 and 2.38.2.

Critical Impact
Authenticated users with the role:manageProject permission can enumerate members and harvest email addresses from projects they are not authorized to view.

Affected Products

n8n versions prior to 2.37.7
n8n versions in the 2.38.x branch prior to 2.38.2
Deployments exposing the affected role.controller.ts REST endpoints

Discovery Timeline

2026-09-08 - CVE-2026-86085 published to NVD
2026-09-09 - Last updated in NVD database

Technical Details for CVE-2026-86085

Vulnerability Analysis

The vulnerability resides in packages/cli/src/controllers/role.controller.ts. The controller exposes two REST endpoints used to manage role assignments across projects: /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members. Both endpoints enforced a scope check that confirmed the caller could manage the role type in question. Neither endpoint validated that the caller was authorized to view the specific project referenced by :projectId or by the role scope. The project:list scope was never evaluated, breaking the tenant isolation model that n8n workspaces rely on.

An authenticated user holding the role:manageProject scope can therefore request assignment metadata for arbitrary projects. The API responds with the member roster of the target project, including names and email addresses. This constitutes an information disclosure through broken access control rather than a code execution or persistence flaw.

Root Cause

The root cause is a missing authorization check on a resource identifier accepted from user input. The controller trusts the :projectId path parameter and role slug without cross-checking the caller's ability to see the referenced project. This is a textbook [CWE-862] Missing Authorization pattern where a coarse scope substitutes for per-object access enforcement.

Attack Vector

Exploitation requires an authenticated account with the role:manageProject privilege. The attacker issues an authenticated GET request against the vulnerable endpoint and supplies the target project identifier. No user interaction or elevated network position is required. The endpoint is network-reachable in any standard n8n deployment. See the GitHub Security Advisory GHSA-cqr2-h44g-v75v for the vendor's technical description.

Detection Methods for CVE-2026-86085

Indicators of Compromise

Requests to /rest/roles/:slug/assignments or /rest/roles/:slug/assignments/:projectId/members originating from accounts that do not otherwise interact with the referenced project.
High-volume enumeration of sequential or varied projectId values in access logs.
Unexpected role:manageProject role assignments granted to lower-privilege users.

Detection Strategies

Correlate n8n audit logs with project membership data to flag callers requesting assignments for projects they cannot list through the UI.
Alert when the same session queries assignment endpoints across many distinct projectId values within a short window.
Compare API responses containing member email addresses against expected caller-to-project relationships.

Monitoring Recommendations

Forward n8n application and reverse-proxy access logs to a centralized analytics platform for retention and query.
Baseline normal usage of the roles REST endpoints and alert on statistical deviations.
Review role assignment change events to detect privilege drift toward role:manageProject.

How to Mitigate CVE-2026-86085

Immediate Actions Required

Upgrade n8n to version 2.37.7 or 2.38.2, matching the branch currently deployed.
Audit accounts holding the role:manageProject scope and revoke the privilege where it is not required.
Review recent access logs for the affected endpoints to identify potential prior enumeration.

Patch Information

The vendor released fixes in n8n Release v2.37.7 and n8n Release v2.38.2. The patches add the missing project:list scope check to the affected controller so that callers can only enumerate members of projects they are authorized to view.

Workarounds

Restrict assignment of the role:manageProject scope until upgrade completes.
Place the n8n API behind an authenticating reverse proxy that restricts /rest/roles/* paths to trusted administrative accounts.
Rotate exposed email addresses out of critical notification channels if enumeration is confirmed.

bash

# Verify installed n8n version and upgrade
n8n --version
npm install -g n8n@2.38.2