CVE-2026-110852: n8n 0 to before 1.123.83, 2.0.0 to before 2.41.4, 2.42.0 to before 2.42.1

Affected technology

n8n · 0 to before 1.123.83, 2.0.0 to before 2.41.4, 2.42.0 to before 2.42.1
n8n-io

Description’s affected range: before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials. Vendor/CNA’s CVSS 4.0 assessment (base score 6.3/10) rates confidentiality and integrity impact as low; availability impact as none.