Five flaws patched in n8n workflow automation platform

Five security advisories for the workflow automation tool n8n were published on 10 September 2026, covering flaws that could let a user freeze an entire instance, bypass a credential's domain restrictions, release a paused approval gate without an account, read other users' workflow identifiers, or poison shared memory in the main process. All five have fixes available.

According to the advisory for CVE-2026-86081, the Git node's clone operation matched its destination path against the default N8N_BLOCK_FILE_PATTERNS expression, which was written in a way that let a crafted path trigger catastrophic backtracking, a pattern-matching blow-up that consumes runaway CPU. Because the check runs synchronously in the main n8n process, the advisory says an authenticated user could freeze the instance for everyone with a single workflow execution and no unusual configuration. The patch rewrites the pattern so matching scales linearly with path length.

A second advisory, CVE-2026-86082, concerns the OpenAI Chat Model node. The node checked a custom base URL against the credential's allowed-domains setting before sending a request, but the model-search dropdown did not. A request setting options.baseURL on that path could reach an arbitrary host with the credential attached, meaning an administrator's domain restriction did not hold on every route. n8n says the fix routes all OpenAI call sites, including model listing, through one shared check. The advisory advises auditing domain-restricted openAiApi credentials, revoking use-only shares to untrusted users and rotating any secrets that may have been exposed.

The third flaw, CVE-2026-86077, affected the /chat WebSocket route, which resumed a paused execution from a resume token without checking that the node being resumed was a chat node. n8n hands such tokens to anonymous form submitters, so the advisory says a party with no account could present one on the chat route and release an execution waiting at an approval gate, described as the control an author puts in front of an action considered too consequential to automate. The patch limits resume over the chat route and Chat Hub to chat-capable node types.

CVE-2026-86994 concerns disclosure between users. The /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing, and activation, deactivation and publication push events were broadcast to all connected clients, carrying workflow IDs, version IDs and activation-error detail. The patch scopes both the listing and the push events through the sharing service.

The fifth advisory, CVE-2026-86078, describes prototype pollution in the Instance AI workflow summary, which built its result using node names and connection keys taken from the stored workflow. Those are arbitrary strings, and n8n says the restricted-name guard shown in the editor is client-side and can be bypassed by posting a workflow straight to the REST API. A reserved key such as __proto__ therefore resolved up the prototype chain and the write landed on Object.prototype in the main process, affecting every later request. The fix uses null-prototype accumulators and validates accepted keys.

The Git node, OpenAI node and cross-user disclosure issues are fixed in n8n 1.123.76, 2.37.7 and 2.38.2. The approval-gate bypass and prototype pollution issues are fixed in 2.37.7 and 2.38.2. Each advisory lists temporary mitigations, including restricting instance access to fully trusted users, excluding the Git node, and leaving the N8N_INSTANCE_AI_MODEL* variables unconfigured. n8n says these workarounds do not fully remediate the risk.