n8n: Per-Resource OAuth Consent Bypass via Unbound Refresh Token Resource Substitution
n8n
- Severity
- High, CVSS 7.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
- Record
- CVE-2026-86073
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- September 8, 2026
- Source last modified
- September 11, 2026
Description
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.1, the OAuth token endpoint bound an authorization code's first access token to the consented resource but did not bind its refresh token. Refreshing checked only that the requested resource was registered, not that it matched the original grant. An OAuth client approved for one workflow could substitute a different workflow URL in the resource parameter and obtain a valid token for an unapproved workflow accessible to the consenting user. This issue is fixed in versions 2.37.7 and 2.38.1.
Description quoted from the NVD record.
Who is affected
n8n is a tool for automating tasks by connecting apps and services into step-by-step workflows. This flaw affects versions before 2.37.7 and 2.38.1. It is in the feature that lets an outside app ask a user for permission to use one of their workflows. When that permission is renewed, n8n does not check that it still covers the workflow the user approved. So an outside app approved for one workflow could get working access to a different workflow that the same user can reach, without that user's approval. This flaw is rated High.
What to do
- The person who installed or runs n8n for your organization should handle this, or the IT provider or vendor who manages it for you.
- Update n8n to one of the versions that fix this flaw:
2.37.7or2.38.1. - If an IT provider or vendor runs n8n for your organization, send them this advisory and ask when the update will be done.
- No workaround is named for this flaw, so updating is the way to close it.
Analysis written from the source record as of September 11, 2026 and reviewed before publishing.