CVE-2026-86994: 
NixOS vulnerability analysis and mitigation

CVE-2026-86994 is an information disclosure vulnerability in n8n, an open-source workflow automation platform, caused by missing authorization checks on the /rest/active-workflows endpoint and real-time push event broadcasts. Any authenticated instance member can enumerate all active workflow IDs on the instance regardless of sharing permissions, and receive real-time lifecycle events (activation, deactivation, publication) containing workflow IDs, version IDs, and activation error details for workflows they should not be able to access. The vulnerability was published on September 2, 2026, and affects n8n versions prior to 1.123.76, 2.0.0–2.37.6, and 2.38.0–2.38.1. It carries a CVSS v3.1 score of 4.3 (Medium) and a CVSS v4.0 score of 5.3 (Medium) (GitHub Advisory, n8n Security Advisory).

The root cause is CWE-862 (Missing Authorization): the active-workflows.service.ts and workflow-push-notifier.service.ts files in packages/cli/src/ did not filter results or push events by the requesting user's identity or sharing permissions. When a member calls GET /rest/active-workflows, the service returns every active workflow ID on the entire instance rather than scoping the response to workflows the user is permitted to access. Similarly, the push notifier broadcasts workflow lifecycle events (activation, deactivation, publication) to all connected WebSocket clients without checking whether the recipient has access to the affected workflow, leaking workflow IDs, version IDs, and activation error details. The fix scopes both the listing endpoint and push events through the sharing service so that users only receive data for workflows they are authorized to view (n8n Security Advisory, GitHub Advisory).

Successful exploitation allows any authenticated n8n member — including low-privileged global:member accounts — to enumerate all active workflow IDs across the entire instance, regardless of sharing configuration. Attackers can also passively receive real-time push events disclosing workflow IDs, version IDs, and activation error details for workflows they have no legitimate access to. While there is no direct integrity or availability impact, the disclosed metadata could be used for reconnaissance to identify high-value automation workflows, understand instance structure, or facilitate further targeted attacks against specific workflows or integrations (n8n Security Advisory).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability requires low-level authenticated access (a valid global:member account) and is exploitable over the network with low complexity and no user interaction. The EPSS score is approximately 0.246% (16th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and no threat actor attribution has been reported.

1. Obtain authenticated access: Acquire or register a low-privileged global:member account on the target n8n instance.
2. Enumerate active workflows: Send an authenticated HTTP GET request to the /rest/active-workflows endpoint (e.g., GET https://<n8n-instance>/rest/active-workflows with a valid session cookie or API token). The response will contain all active workflow IDs on the instance, regardless of sharing permissions.
3. Establish WebSocket connection: Connect to the n8n WebSocket push notification channel using the authenticated session to receive real-time lifecycle events.
4. Collect disclosed metadata: Monitor incoming push events for workflow activation, deactivation, and publication messages, which carry workflow IDs, version IDs, and activation error details for workflows the attacker is not authorized to access.
5. Use metadata for reconnaissance: Leverage the collected workflow IDs and error details to map the instance's automation landscape, identify sensitive or high-value workflows, and plan further targeted actions (n8n Security Advisory, GitHub Advisory).

• Network: Repeated or scripted GET requests to /rest/active-workflows from accounts that do not own or have sharing access to most workflows on the instance; unexpected WebSocket connections from low-privileged member accounts that remain open for extended periods.
• Logs: n8n access logs showing frequent calls to /rest/active-workflows from a single user or IP, especially outside normal business hours; WebSocket session logs showing a member account receiving a disproportionately large number of workflow lifecycle push events.
• Behavioral: A global:member account querying the active workflows endpoint repeatedly or immediately after login, suggesting automated enumeration rather than normal UI interaction.

Upgrade n8n to one of the patched versions: 1.123.76, 2.37.7, or 2.38.2 (or later), which scope both the /rest/active-workflows listing and push event broadcasts through the sharing service so users only receive data for workflows they are authorized to access (n8n Security Advisory, Release 1.123.76, Release 2.37.7, Release 2.38.2). If immediate patching is not possible, restrict n8n instance access to fully trusted users only and avoid provisioning global:member accounts for untrusted users. Additionally, consider restricting network-level access to the /rest/active-workflows endpoint via a reverse proxy or firewall rule as a temporary measure. These workarounds do not fully remediate the risk and should only be used as short-term mitigations.