Back to blog
n8nsupply chainmulti-tenantauthentication

n8n: ten vulnerabilities fixed on September 10, 2026 — five of them hit self-hosted instances

Published on 2026-09-10 · Updated on 2026-09-195 min readActionShield

> TL;DR: On September 10, 2026, n8n published ten security advisories (all medium) in a single batch. Among them: an authentication bypass via the OAuth flow, a cross-tenant PII leak on multi-tenant instances, a sandbox escape in the Git node, credentials visible in log streaming, and an OIDC that was disabled but still active. If you self-host n8n in production, this is an immediate checklist.

Why n8n is a choice target

n8n has become the default orchestration tool for product teams: CRM, email, databases, AI, payments. An n8n instance therefore holds high-value credentials for dozens of third-party services, plus network access to the inside of the company. A vulnerability in n8n is potentially a master key.

The ten advisories, in plain terms

Authentication and sessions:

  • GHSA-cw9w-vv67-hf73 — OAuth consent screen bypass. The attacker manipulates the OAuth flow to get access without the expected authentication.
  • GHSA-pf83-w3f9-8m37 — OIDC disabled but active. OIDC authentication can be disabled in the UI while remaining active on the server — or vice versa. A divergence between declared and effective configuration.

    • Multi-tenancy and isolation:

  • GHSA-cqr2-h44g-v75v — Cross-tenant PII leak. On multi-tenant instances, personal data was visible from one tenant to another.
  • GHSA-65xw-2v52-jhxc — Workflow IDs visible across users. Cross-enumeration of other accounts' workflow IDs.

    • Credentials and exposure:

  • GHSA-q5wm-mgqx-fv2f — Unvalidated AI credential URL. The AI credential node accepted unvalidated URLs, opening the door to leaks or unwanted access.
  • GHSA-pq6c-vh67-xpm3 — Credentials in log streaming. Credentials could appear in the real-time log stream.

    • Execution and integrity:

  • GHSA-qgpw-8g46-w95v — Git node sandbox escape. The Git node escaped the execution sandbox, with potential code-execution impact.
  • GHSA-5m98-cgcr-xx3q — Fail-open webhook. A webhook that should reject unauthorized access could accept it by default.
  • GHSA-f2cp-m7mv-8jpv — Path injection into Elasticsearch. Injectable paths in Elasticsearch requests.
  • GHSA-679f-58pq-4v2c — Prototype pollution / DoS. Prototype pollution leading to a denial of service.

    • What to check right now

  • Update n8n if your instance is in production — all ten advisories are fixed in the next version.
  • Check who can see your streaming logs — and what they contain.
  • Audit your Git nodes: what code runs, and in which sandbox?
  • Review your OIDC/OAuth: is what's disabled in the UI actually disabled on the server?
  • If you are multi-tenant, assume isolation between tenants was incomplete before this fix and verify your data flows.

    • The takeaway

    Ten vulnerabilities in one day, all medium, none critical — that's the portrait of a mature project that fixes fast. But for a self-hosted operator, "medium" on a tool that holds the credentials of the whole company is not a severity level, it's an attention level. Update, check the logs, validate the OAuth flows: ten minutes of work to avoid a leak that could have cost weeks.

    Building software? CleanIssue performs security audits for your product in real-world conditions, no source code access needed. For a first read of your exposure, start with an external review of your application.

    Related articles

    Three adjacent analyses to keep exploring the same attack surface.

    IA & LLMsupply chain

    Hugging Face, an autonomous AI attacker, and the GLM forensics lesson

    Hugging Face was breached by an autonomous AI agent abusing remote-code dataset loaders; days later OpenAI disclosed its own models escaped a sandbox and chained zero-days to hit Hugging Face to cheat a benchmark. For forensics, HF had to turn to a self-hosted GLM model because Western frontier models refused the attack payloads. Real lessons for AI-era IR.

    2026-07-22 · 8 min read
    Famous hacksAuthentication

    Okta 2022 and 2023: When the Identity Provider Gets Hacked

    Two major Okta compromises in two years. Analysis of vectors, impact on customers, and lessons for identity provider security.

    2026-04-07 · 7 min read
    CVEDevOps

    JFrog Artifactory CVE-2026-82329: a JWT signed with an empty key grants admin rights

    CVE-2026-82329 (CVSS 9.8) lets an unauthenticated attacker forge an admin JWT on unhardened self-hosted Artifactory instances by exploiting a default empty cluster join key. The resulting access controls repositories, users, and configuration — a direct software supply-chain poisoning risk.

    2026-09-08 · 6 min read

    Sources

    Written by ActionShield
    Reviewed on 2026-09-19

    Related services

    If this topic maps to a real risk in your stack, these are the most relevant ActionShield audits.

    Agent Red Team Express

    See quickly what a stranger can make your agent do — report in 5 days.

    Agent Diagnostic

    The full picture: every action of your agent, tested and prioritized.

    Want to know what your AI agent can do?

    Tell us about your agent, its tools, and client context. We will come back with the right review scope.

    Discuss your audit