CVE-2026-86993: 
NixOS vulnerability analysis and mitigation

CVE-2026-86993 is a missing authorization vulnerability in n8n, an open-source workflow automation platform, affecting its Log Streaming event destination feature. The flaw allows an authenticated user with a custom global role carrying Log Streaming scopes to decrypt and exfiltrate credentials belonging to other projects without an ownership check. Affected versions include all releases prior to 1.123.76 (v1 branch), 2.37.7 (v2.37.x branch), and 2.38.2 (v2.38.x branch). The vulnerability was published on September 2, 2026, and carries a CVSS v3.1 base score of 4.9 (Medium) and a CVSS v4.0 score of 5.9 (Medium) (GitHub Advisory, n8n Security Advisory).

The root cause is CWE-862 (Missing Authorization): the Log Streaming event destination code in packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts resolved and decrypted any credential ID referenced by a destination without verifying that the requesting user had ownership or access rights to that credential. An attacker holding a custom global role with Log Streaming scopes (e.g., eventBusDestination:create, eventBusDestination:test) and the credential:read scope could configure a malicious HTTP destination referencing a credential ID belonging to another project, causing n8n to decrypt and transmit the secret to an attacker-controlled endpoint. The fix applies the standard credential access check at the point where a destination resolves its credential (n8n Security Advisory, GitHub Advisory).

Successful exploitation results in high confidentiality impact: decrypted credential secrets (such as API keys, tokens, or passwords) stored in other projects can be exfiltrated to an attacker-controlled HTTP endpoint. There is no integrity or availability impact. The scope is limited to the vulnerable n8n instance, but stolen credentials could enable lateral movement into third-party services or systems integrated with n8n workflows, potentially expanding the blast radius significantly beyond the platform itself (GitHub Advisory, n8n Security Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). Exploitation requires the attacker to already hold a privileged account with a custom global role carrying Log Streaming scopes, which limits the attack surface. The EPSS score is approximately 0.272% (19th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD's SSVC assessment classifies exploitation as "none" at this time (n8n Security Advisory).

1. Obtain privileged access: Acquire or compromise an n8n account with a custom global role that includes Log Streaming scopes (eventBusDestination:create, eventBusDestination:test) and the credential:read scope on a vulnerable n8n instance (version < 1.123.76, < 2.37.7, or 2.38.0–2.38.1).
2. Enumerate credential IDs: Use the n8n API or UI to identify credential IDs belonging to other projects that the attacker does not own but wishes to exfiltrate.
3. Set up attacker-controlled endpoint: Deploy an HTTP server (e.g., using ngrok, requestbin, or a VPS) capable of receiving and logging incoming POST requests with credential data.
4. Create malicious Log Streaming destination: Configure a new Log Streaming event destination of type "Generic HTTP" that references the target credential ID (from another project) and points the webhook URL to the attacker-controlled endpoint.
5. Trigger credential decryption: Activate or test the Log Streaming destination. n8n resolves and decrypts the referenced credential without an ownership check, then sends the decrypted secret to the attacker's endpoint.
6. Collect exfiltrated secrets: Retrieve the decrypted credential value from the attacker-controlled HTTP server logs and use it to access downstream services integrated with the victim's n8n workflows (n8n Security Advisory, GitHub Advisory).

• Logs: n8n audit logs showing eventBusDestination:create or eventBusDestination:test actions by users with custom global roles, especially referencing credential IDs from projects they do not own; unexpected credential:read scope usage in access logs.
• Network: Outbound HTTP POST requests from the n8n server to unfamiliar or external webhook URLs originating from the Log Streaming subsystem; connections to newly registered or suspicious domains/IPs not associated with known integrations.
• Configuration: Presence of Log Streaming event destinations configured with external or unrecognized webhook URLs in the n8n admin panel; destinations referencing credentials from projects other than the destination owner's project.
• Credential Activity: Evidence of credential decryption events for credentials belonging to projects not associated with the Log Streaming destination's owner (n8n Security Advisory).

Upgrade n8n to a patched version: 1.123.76 (v1 branch), 2.37.7 (v2.37.x branch), or 2.38.2 (v2.38.x branch), all released on September 2, 2026 (n8n Release 1.123.76, n8n Release 2.37.7, n8n Release 2.38.2). If immediate upgrade is not possible, apply the following temporary mitigations: (1) restrict n8n instance access to fully trusted users only; (2) audit and revoke custom global roles carrying Log Streaming scopes (eventBusDestination:create, eventBusDestination:test); (3) review all existing Log Streaming event destinations for unexpected webhook URLs and remove unrecognized ones; (4) rotate any credentials that may have been referenced by suspicious destinations. These workarounds do not fully remediate the risk (n8n Security Advisory).