CVE-2026-65014

Katalog CVE

CVSS 5.3 · Medium EPSS 0,59%

Kerentanan Missing Authentication for Critical Function pada n8n. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.

Rincian

Terbit di NVD

22 Juli 2026

Terakhir diubah

27 Juli 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-306: Missing Authentication for Critical Function

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75 mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-test-webhook advisory pihak ketiga