PT-2026-36899 · N8N · N8N

Jjjutla + 1 · Published 2026-04-22 · Updated 2026-05-05 · CVE-2026-42227

Positive Technologies (AI Summary)

CVSS v3.1

7.7

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1

Description An authenticated user with a valid API key scoped to variable:list can read variables from projects they are not a member of. This occurs by supplying an arbitrary projectId query parameter to the public API variables endpoint. The handler queries the variables repository directly, bypassing the authorization-aware service layer used by the internal enterprise controller and failing to enforce project membership checks. This issue specifically affects licensed enterprise or team deployments with multiple projects and the variables feature enabled.

Recommendations Update to version 1.123.32. Update to version 2.17.4. Update to version 2.18.1. Rotate any credentials or tokens immediately if they were stored as variables and potentially exposed.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

BDU:2026-06982

CVE-2026-42227

GHSA-756Q-GQ9H-FP22

Affected Products

N8N

References · 9

• https://github.com/n8n-io/n8n/security/advisories/GHSA-756q-gq9h-fp22 · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-06982 · Security Note
• https://osv.dev/vulnerability/GHSA-756q-gq9h-fp22 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42227 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/VulmonFeeds/status/2051541885961806056 · Twitter Post
• https://twitter.com/CVEnew/status/2051383978091851915 · Twitter Post
• https://twitter.com/infoflowcloud/status/2051385407661658273 · Twitter Post
• https://t.me/cveNotify/162076 · Telegram Post