CVE-2026-110851
CVE-2026-110851 · n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user with read-only Agent access to another project can supply an existing Agent ID to move that Agent into their own project and rewrite its name, schema and version.
CVSS 6.1 · Medium · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
n8n
- Versions
- ≥ 0, < 2.41.4: Affected (semver)
- ≥ 2.42.0, < 2.42.1: Affected (semver)
Update to 2.41.4; Update to 2.42.1