n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

## Impact The `DELETE /${restEndpoint}/test-webhook/:id` route is registered before the authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions. Production webhooks, persistent workflow state, and stored data are not affected. ## Patches Users should upgrade to the patched version once available to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict network access to the n8n instance to fully trusted users only. - Place the n8n instance behind a reverse proxy or firewall that requires authentication before reaching the REST API. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Source published

22 Jul 2026 22:36:10 UTC

Source modified

22 Jul 2026 22:56:43 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N

Publisher rating · MODERATE