N8N · GHSA-c772-hjfp-gfc2 · AI agents & MCP
FIX → 3.2.2 · 2.48.3 · 1.123.96 +1
Several n8n integration nodes build API request paths from unencoded parameters such as record or table IDs, so relative path segments can redirect a request to another endpoint of the same service. An attacker who can feed untrusted input, such as a webhook body, into those parameters can read, modify or delete resources using the node's stored credential.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Self-hosted or cloud n8n instances that run workflows where untrusted input, such as a webhook body, reaches the ID or resource parameters of an affected integration node. Workflows that only use fixed IDs or trusted input are not exposed through this path.
Not affected if no-untrusted-input-in-id-parameters, patched-version
Who cares n8n, self-hosted, webhooks
n8n --version or the package.json of the n8n install.Upgrade to 3.2.2 · 2.48.3 · 1.123.96 +1
Multiple n8n nodes built the URL path of their API requests from node parameters such as record, table or resource IDs. These values were not encoded, so a value containing relative path segments could change which endpoint of the same service the request reached. Where a workflow passed untrusted input, such as a webhook body, into one of these parameters, a caller could make the node read, modify or delete resources outside the workflow's intended scope, with the privileges of the node's stored credential.
The issue has been fixed in n8n versions 1.123.96, 2.47.6, 2.48.3 and 3.2.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.
1.123.96, 2.47.6, 2.48.3 or 3.2.2 or later, matching your release line.