An unauthenticated network caller who knows a workflow ID can issue a DELETE request to the /$endpoint/test-webhook/:id route before authentication middleware is executed. The resulting cancellation stops an in‑progress test session but does not affect the workflow’s persistent state, production webhooks, or stored data. Consequently, the flaw provides only a limited Denial‑of‑Service to test functionality rather than a full system compromise.

All n8n instances running a version earlier than 2.28.0, including branches prior to 2.27.4 on the 2.27.x series, are affected. The vulnerability exists in the n8n‑io:n8n product and can be triggered by any user with network connectivity to the exposed endpoint.

The CVSS score of 6.3 classifies the flaw as moderate. The EPSS score of <1% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, implying a low likelihood of exploitation under normal conditions. The attack vector is remote, requiring knowledge of a workflow ID; it does not require elevated privileges or compromise of the host. While exploitation could disrupt testing workflows, it does not threaten production data or credentials.