CVE-2026-86993 Overview
n8n is an open source workflow automation platform used to orchestrate integrations between SaaS applications and internal systems. CVE-2026-86993 is a missing authorization vulnerability [CWE-862] in the Log Streaming feature. Prior to versions 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference any generic HTTP credential by ID and decrypt it without an ownership check. A user holding a custom global role with Log Streaming scopes could exfiltrate secrets belonging to other projects by directing decrypted values to an attacker-controlled endpoint.
Critical Impact
Authenticated users with Log Streaming scopes can decrypt and exfiltrate arbitrary HTTP credentials belonging to other projects, breaking tenant isolation across workflows.
Affected Products
- n8n versions prior to 1.123.76
- n8n versions prior to 2.37.7
- n8n versions prior to 2.38.2
Discovery Timeline
- 2026-09-08 - CVE-2026-86993 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86993
Vulnerability Analysis
The flaw resides in packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts. When a Log Streaming destination is configured to authenticate outbound webhooks using a stored generic HTTP credential, the server resolves the referenced credential ID and decrypts its secret material. The code path does not verify that the caller owns, shares, or otherwise has access to the referenced credential within its project scope.
Any authenticated principal with the credential:read scope inside a custom global role that also grants Log Streaming management can enumerate credential IDs and reuse them in a destination configuration. The decrypted secret is then transmitted as part of the outgoing HTTP request to the destination URL, which the same user controls when defining the destination.
Root Cause
The root cause is a missing authorization check between the Log Streaming destination handler and the credentials store. Ownership and project-scope validation were not enforced before decryption occurred, so scope-based role checks alone were insufficient to prevent cross-project credential access.
Attack Vector
Exploitation requires an authenticated user assigned a custom global role that includes Log Streaming scopes. The attacker creates or edits a Log Streaming destination, references the target credential ID, and sets the destination URL to a server they control. When the destination is exercised, the plaintext credential is delivered to the attacker endpoint over the network. No user interaction from the credential owner is needed.
See the GitHub Security Advisory GHSA-pq6c-vh67-xpm3 for the authoritative technical description.
Detection Methods for CVE-2026-86993
Indicators of Compromise
- Log Streaming destinations pointing to unfamiliar or external hostnames not documented in the environment's outbound integration inventory.
- Newly created or modified destinations that reference credential IDs belonging to projects the modifying user does not own.
- Outbound HTTP requests from the n8n host to attacker-controlled infrastructure carrying Authorization, X-API-Key, or similar credential headers.
Detection Strategies
- Audit the n8n database for entries in the Log Streaming destinations table whose credentialId maps to a project distinct from the destination's owning project.
- Review application logs for Log Streaming destination create and update events performed by users holding custom global roles with the credential:read scope.
- Correlate configuration changes with subsequent outbound network events to non-corporate domains.
Monitoring Recommendations
- Enable egress filtering on the n8n server and alert on outbound HTTP or HTTPS requests to newly seen destinations.
- Continuously monitor changes to role definitions that add Log Streaming or credential:read scopes.
- Alert on any use of the Log Streaming API by non-administrative accounts.
How to Mitigate CVE-2026-86993
Immediate Actions Required
- Upgrade n8n to 1.123.76, 2.37.7, or 2.38.2 as appropriate for your release branch.
- Rotate all generic HTTP credentials that were reachable by users holding Log Streaming scopes before the upgrade.
- Review and reduce the membership of custom global roles that combine credential:read with Log Streaming permissions.
Patch Information
The upstream fix enforces an ownership and project-scope check inside destination-credentials-access.ts before decryption. Patched releases are available at n8n@1.123.76, n8n@2.37.7, and n8n@2.38.2.
Workarounds
- Temporarily remove Log Streaming scopes from all custom global roles until the patched version is deployed.
- Restrict outbound network access from the n8n server to an allowlist of known logging destinations.
- Disable Log Streaming destinations that use generic HTTP credential authentication and switch to destinations with no credential reference where possible.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.