CVE-2026-110851 Details
Description
n8n before 2.41.4 and 2.42.x before 2.42.1 contains an authorization bypass in the Agents create endpoint, which accepts a caller-supplied Agent ID, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it. An authenticated user with read-only Agent access to another project can supply an existing Agent ID to move that Agent into their own project and rewrite its name, schema and version.
A vulnerability allowing authorization bypass has been identified in n8n versions prior to 2.41.4 and in the 2.42.x series before 2.42.1. The issue resides in the Agents create endpoint, which accepts a user-supplied Agent ID. The endpoint only checks permissions against the requested project, failing to verify the ownership of the Agent in question. This flaw enables an authenticated user with read-only access to Agents in one project to transfer an Agent from another project into their own, while also altering the Agent's name, schema, and version.
Users can upgrade to n8n versions 2.42.1 or 2.41.4 to address this vulnerability. If an immediate upgrade is not possible, consider restricting access to trusted users, auditing project memberships to remove unnecessary viewer access, or disabling the agents module if it is not needed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n | < 2.41.4 (semver) < 2.42.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 20, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |