CVE-2026-110852
2026-10-14
23h17 +00:00
23h17 +00:00
指定 CVE 通知
掌握特定 CVE 的任何變更。
CVE 描述
n8n before 1.123.83, 2.x before 2.41.4, and 2.42.x before 2.42.1 contains an authentication bypass because dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL's only unguessable component. Unauthenticated attackers can omit this identifier in requests to webhook, form, or MCP routes to execute workflows in unrelated projects under those projects' credentials.
CVE 資訊
相關弱點
| 弱點名稱 | 來源 | |
|---|---|---|
| Authentication Bypass Using an Alternate Path or Channel The product requires authentication, but the product has an alternate path or channel that does not require authentication. |
