🕵️ RESEARCH & DEEP DIVES
n8n cross-tenant PII disclosure via missing scope check on role assignment endpoints (CVE-2026-86085)
n8n versions before 2.37.7 and 2.38.2 leak project member names and email addresses across tenants due to a missing project:list scope check on role assignment endpoints.- Affects n8n self-hosted and Cloud instances running versions before 2.37.7 (2.37.x) or before 2.38.2 (2.38.x).
- The /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members endpoints only checked whether the caller could manage the role type, omitting the project:list scope check (CWE-862, in packages/cli/src/controllers/role.controller.ts).
- A caller with the role:manageProject capability could name a project they could not list and obtain its member names and email addresses.
- Rated Medium 5.1 (CVSS v4.0) by GitHub_M; fixed in n8n 2.37.7 and 2.38.2, tracked as GHSA-cqr2-h44g-v75v.
n8n log streaming flaw let users decrypt other projects' credentials (CVE-2026-86993)
n8n fixed a missing-authorization flaw in Log Streaming event destinations that allowed decryption of credentials belonging to other projects.- Applies to n8n self-hosted and Cloud instances prior to versions 1.123.76, 2.37.7, and 2.38.2 (including all 2.x below 2.37.7 and any below 1.123.76).
- A Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check (CWE-862, missing authorization).
- A user with a custom global role carrying Log Streaming scopes could select a credential from another project and send its decrypted secret to an attacker-controlled endpoint.
- The affected authorization boundary is packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts and the credential:read scope; CVSS 4.0 score 5.9 (Medium).
n8n fixes cross-user disclosure of active workflow IDs via /rest/active-workflows endpoint (CVE-2026-86994)
n8n patched an information disclosure flaw that leaked active workflow IDs and lifecycle events to users without access to those workflows.- Affects n8n versions prior to 1.123.76, 2.37.7, and 2.38.2 (CVE-2026-86994, CVSS 5.3, CWE-862 missing authorization).
- The /rest/active-workflows endpoint returned every active workflow ID on the instance to any member, regardless of workflow sharing.
- Activation, deactivation, and publication push events were broadcast to clients lacking access, disclosing workflow IDs, version IDs, and activation error details.
- Affected code paths include packages/cli/src/services/active-workflows.service.ts and packages/cli/src/workflows/workflow-push-notifier.service.ts.
- Fixed in n8n 1.123.76, 2.37.7, and 2.38.2; vulnerability tracked under GHSA-65xw-2v52-jhxc.
n8n flaw CVE-2026-86996: Agent workflow tool bypassed sub-workflow caller policy
n8n fixed a flaw where workflows attached to AI Agents as tools bypassed the 'This workflow can be called by' restriction.- Affects n8n open source workflow automation platform, versions prior to 2.37.7 and prior to 2.38.2.
- The 'This workflow can be called by' caller policy was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool.
- A user able to build an Agent could invoke a restricted workflow and read its returned data (CWE-862 Missing Authorization, CVSS 5.3).
- The flaw was in packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omitted SubworkflowPolicyChecker.checkForProject.
- Fixed in n8n 2.37.7 and 2.38.2; tracked as CVE-2026-86996 with GitHub advisory GHSA-7hgx-277f-7vmg.
ScreenConnect Client critical RCE flaw CVE-2026-84869 allows unauthorized file transfer and execution
A critical vulnerability (CVE-2026-84869) in the ScreenConnect client allows unauthorized file transfer and remote code execution.- Applies to users of the ScreenConnect remote access client.
- A critical vulnerability allows unauthorized file transfer and execution, leading to remote code execution.
- CVE-2026-84869 was published September 8, 2026, with a CVSS score of 9.9.
Jason Haddix: Stop fearing AI pentesting
Jason Haddix argues AI pentesting is viable and human methodology is what makes it work.- Applies to security teams relying on manual penetration testing
- Argument: manual pentesting can't keep pace with modern attack surfaces
- Claims human methodology is the key ingredient that makes AI pentesting effective
🕵️ RESEARCH & DEEP DIVES
Patch Tuesday Sets Another Record With 974 CVEs — Dark Reading
Attackers Use Multi-Hop Google Redirects for Phishing Campaign — Dark Reading
OpenAI Agents Took Over Wiki Site Before Hugging Face Attack — Dark Reading
Feds accuse China of ‘systematic’ distillation of U.S. AI models — CyberScoop
Microsoft Plugs Nearly 1,000 Security Holes — Krebs on Security
Maravel-Framework Token Replay Vulnerability via Premature JWT Blacklist Evic... — CVE ThreatInt
Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Or... — CVE ThreatInt
Missing Authorization in Stack/Container Sub-Block Asset RegistrationConcrete... — CVE ThreatInt
n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client R... — CVE ThreatInt
n8n: Expression Sandbox Escape in Editor-UI Enables Stored Cross-User JavaScr... — CVE ThreatInt
n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebS... — CVE ThreatInt
n8n: Prototype Pollution via Workflow Structure Summary Can Lead to Denial of... — CVE ThreatInt
n8n: Path Injection in Elasticsearch and ElasticSecurity Nodes via Unencoded ... — CVE ThreatInt
n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Sign... — CVE ThreatInt
n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern... — CVE ThreatInt
n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI ... — CVE ThreatInt
n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer ... — CVE ThreatInt
n8n: Disabled OIDC SSO Endpoints Remain Active and Issue Valid Sessionsn8n is... — CVE ThreatInt
n8n: Git Node branch..remote Config Key Bypasses Sandbox Path Restricti... — CVE ThreatInt
• *