CVE-2026-65014
CVE-2026-65014 · n8n before 2.28.0 Authentication Bypass via test-webhook
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.
CVSS 6.3 · Media · EPSS 0,6% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node