Path Injection in n8n Elasticsearch and ElasticSecurity Nodes

The Elasticsearch and ElasticSecurity nodes in n8n allowed path injection attacks through unencoded identifiers, enabling attackers to access unintended endpoints or documents using stored Elasticsearch credentials. The vulnerability was patched in versions 1.123.76, 2.37.7, and 2.38.2.

Disclosed 10 September 2026 · Record updated 1 October 2026

Impact

Attackers could manipulate Elasticsearch and ElasticSecurity node operations to access unintended indices or cluster administration endpoints using stored credentials.

Our coverage

A network of pipes suddenly branches at unmarked junctions, with water streams diverted down unexpected passages toward locked administrative chambers instead of their intended destinations.

Vulnerabilities

n8n patches path injection in its Elasticsearch nodes

A flaw disclosed on 10 September 2026 let crafted identifiers redirect n8n workflow requests to other indices or cluster admin endpoints.

14 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-f2cp-m7mv-8jpv