CVE-2026-110851
CVE-2026-110851 · n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user with read-only Agent access to another project can supply an existing Agent ID to move that Agent into their own project and rewrite its name, schema and version.
CVSS 6.1 · Media · EPSS 0,2% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
n8n
- Versiones
- ≥ 0, < 2.41.4: Afectada (semver)
- ≥ 2.42.0, < 2.42.1: Afectada (semver)
Actualiza a 2.41.4; Actualiza a 2.42.1