CVE-2026-86079

n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

Published Sep 8, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Analysis

Technical impact

The vulnerability permits path injection by directly interpolating workflow‑controlled index and document identifiers into REST request paths without proper encoding. An attacker can supply an identifier that contains path separators or dot segments, causing the request to target a different index or a cluster administration endpoint under the stored Elasticsearch credentials. This can lead to unauthorized data discovery, modification or deletion, and potentially elevate privileges within an Elasticsearch cluster.

Affected Systems

The issue affects n8n-io:n8n workflows running any of the following versions: any release before 1.123.76, 2.37.7, or 2.38.2.

Risk and Exploitability

The CVSS score of 6.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires input of a malicious identifier in a workflow; therefore the attack vector is likely an insider or an attacker who has gained the ability to create or modify workflows. No publicly available exploit is known, but the risk remains if untrusted users can define identifiers that are passed to Elasticsearch nodes.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n8n-io

n8n

affected

Version	Status	Constraints
`>= 2.38.0, < 2.38.2`	affected	—
`>= 2.0.0, < 2.37.7`	affected	—
`< 1.123.76`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:n8n:n8n::::::node.js::*
	cpe:2.3:a:n8n:n8n::::::node.js::*
	cpe:2.3:a:n8n:n8n::::::node.js::*

No data.

Vendor Product Versions

N8n

Version	Status	Scheme	Platform
`[2.38.0,2.38.2)`	affected	semver	—
`[2.0.0,2.37.7)`	affected	semver	—
`[0,1.123.76)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2 or later to receive the fixed code that encodes path segments properly.
If an upgrade is not immediately possible, validate or sanitize all workflow identifiers before they are passed to the Elasticsearch or ElasticSecurity nodes by removing or escaping path separators and dot segments.
Restrict the creation and modification of workflows that use these nodes to trusted users only, and monitor for anomalous identifier patterns.

Generated by OpenCVE AI on September 9, 2026 at 09:11 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-f2cp-m7mv-8jpv	n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact High

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.491% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cp-m7mv-8jpv

History

Sep 11, 2026 11:45 PM First appearance in the feed. Affected versions updated. Affected vendors updated. Scoring metrics updated View changes

Type	Values Removed	Values Added
First Time appeared		N8n N8n n8n
CPEs		cpe:2.3:a:n8n:n8n::::::node.js::*
Vendors & Products		N8n N8n n8n
Metrics		cvssV3_1 `{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}`

Sep 9, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Sep 8, 2026 9:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Title		n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers
Weaknesses		CWE-22
References		https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.76 https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7 https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2 https://github.com/n8n-io/n8n/security/advisories/GHSA-f2cp-m7mv-8jpv
Metrics		cvssV4_0 `{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N'}`