Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

n8n Unauthenticated Test Webhook Cancellation

published 3 months ago

Summary

An outdated version of n8n allows anyone to cancel test webhooks without logging in. This only affects in-progress test sessions, not production workflows or data. Update to a newer version of n8n to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Ecosystem	Vendor	Product	Affected versions
npm	GitHub Actions	n8n	All versions

Original advisory text

Duplicate Advisory: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-33q9-f52j-gc75. This link is maintained to preserve external references.

## Original Description

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions; production webhooks, persistent workflow state, and stored data are not affected.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

7.8 High

Type

CWE-306Missing Authentication for Critical Function

Timeline

Published22 Jul 2026

Updated22 Jul 2026

First seen22 Jul 2026

Sources

GHSA-h9fm-xcv2-qfw3 · OSV

Track software like this

Free during beta