Riskcovery

CVE-2026-86079

n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded Identifiers

State
Published
Severity
6.3 Medium
Published
Sep 8, 2026
Updated
Sep 9, 2026
Reserved
Sep 4, 2026

Read the record on cve.org

Description

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the Elasticsearch and ElasticSecurity nodes interpolated workflow-controlled index and document identifiers directly into REST request paths. An identifier containing path separators or dot segments could select another index or a cluster administration endpoint under the stored Elasticsearch credential. The affected request construction includes packages/nodes-base/nodes/Elastic/Elasticsearch/GenericFunctions.ts and the missing toPathSegment encoding. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Scores

CVSSScoreVectorSource
4.06.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:NGitHub_M

Weaknesses

  • CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Affected Products

ProductVersions
n8nn8n-io
  • >= 2.38.0, < 2.38.2Affected
  • >= 2.0.0, < 2.37.7Affected
  • < 1.123.76Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.