CVE-2026-65014
MEDIUMn8n before 2.28.0 Authentication Bypass via test-webhook
Title source: cnaDescription
n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-33q9-f52j-gc75)
https://github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75
Third Party Advisory third-party-advisory
VulnCheck Advisory: n8n before 2.28.0 Authentication Bypass via test-webhook
https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-test-webhook
Scores
CVSS v3
5.3
EPSS
0.0029
EPSS Percentile
20.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-306
Status
published
Products (6)
n8n/n8n
2.27.0 - 2.27.4 (2 CPE variants)
n8n-io/n8n
< 2.27.4
n8n-io/n8n
< 2.28.0
n8n-io/n8n
2.27.4
n8n-io/n8n
2.28.0
npm/n8n
0 - 2.27.4npm
Published
Jul 22, 2026
Tracked Since
Jul 22, 2026