CVE-2026-110851

Executive Summary

CVE-2026-110851 is an authorization bypass (CWE-639) in the n8n workflow automation platform affecting versions before 2.41.4 and 2.42.x before 2.42.1. The Agents create endpoint accepts a caller-supplied Agent ID and validates permissions only against the requested project rather than the project that owns the target Agent, allowing an authenticated user with read-only Agent access to another project to reassign that Agent into their own project. Successful exploitation permits cross-tenant integrity compromise of Agent resources — including name, schema, and version — without requiring elevated privileges or any special access to the victim project.

Technical Analysis

The vulnerability resides in the Agents create endpoint of n8n. Under normal expected behavior, an Agent resource should be scoped to a project, and any mutation operation should verify that the requesting identity holds write or ownership permissions over the project that currently owns the Agent. In the vulnerable implementation, the endpoint performs its authorization check only against the project specified (or implied) by the caller — not against the project that owns the existing Agent being modified.

The core flaw is a classic object-reference authorization failure (CWE-639). Because the Agent ID is supplied by the caller and is not re-validated against the owning project, the following sequence becomes possible:

1. An authenticated user obtains read-only access to an Agent in a project they do not own.
2. That user submits a create/update request to the Agents endpoint supplying the existing Agent's ID.
3. The endpoint checks permissions against the caller's own requested project, not the source project.
4. The Agent is moved into the caller's project, and its name, schema, and version are rewritten.

The attack surface is the Agents management API exposed by the n8n instance. Any n8n deployment — self-hosted or cloud — where an attacker can obtain a low-privilege authenticated account and at least read-only visibility into a shared or adjacent project is in scope. The flaw requires no user interaction on the victim side and no elevated role.

Because the NVD description is the sole authoritative technical source available for this CVE, no internal function or class names beyond the "Agents create endpoint" are asserted here. The mechanism is fully described by the vendor-provided text.

Exploitation Scenarios

1) Reconnaissance / target identification. The attacker requires a valid authenticated session on the n8n instance. They enumerate or otherwise become aware of project and Agent identifiers through normal application visibility, including any read-only Agent access granted across projects. In multi-tenant n8n deployments, shared instances, or instances where project membership is loosely governed, this reconnaissance step is trivial.

2) Triggering the flaw class. The attacker issues a request to the Agents create endpoint, substituting or supplying the Agent ID of a resource owned by another project. The endpoint validates permissions only against the project the caller is targeting rather than the project that owns the referenced Agent.

3) Execution. Because the ownership check is absent, the request succeeds. The referenced Agent is reassigned to the attacker's project. The attacker also rewrites the Agent's name, schema, and version in the same request. No public PoC exists for this CVE; the attack chain is inferred directly from the CVE description and the object-reference authorization class. No additional implementation detail is fabricated here.

4) Post-exploitation impact. The attacker gains control over an Agent that legitimately belongs to another tenant, enabling modification of its configuration, schema, and version. Downstream workflows that depend on that Agent may be hijacked, destabilized, or manipulated to process attacker-controlled data. Deletion or destructive modification of dependent automations is possible through subsequent legitimate-privilege actions on the now-owned Agent.

Impact Assessment

The impact is a cross-tenant integrity violation. Using CVSS 3.1 subscores consistent with the described behavior:

• Confidentiality (C:L) — limited; the attacker gains read access to the reassigned Agent's configuration and may observe downstream data flows.
• Integrity (I:H) — high; name, schema, and version of an Agent owned by another project can be arbitrarily rewritten.
• Availability (A:N) — none directly; however, rewrites to schema/version can break dependent workflows and effectively degrade availability of automations.

Blast radius: any n8n instance (self-hosted or cloud) running an affected version with more than one project or shared Agent access. Because the attacker needs only an authenticated low-privilege account, insider threat and compromised-credential scenarios are the primary vectors. Organizations using n8n as an orchestration layer for sensitive integrations (ticketing, CRM, SIEM enrichment, CI/CD) should treat affected Agents as high-value targets.

Detection Guidance

Sigma Rule

title: n8n Agent Cross-Project Reassignment (CVE-2026-110851)
id: 9f2a7c14-6b3e-4d1a-8f02-2a1e5c9d7b44
status: experimental
description: Detects Agent create/update requests in n8n that reference an Agent ID belonging to a different project, indicative of CWE-639 authorization bypass.
logsource:
  product: n8n
  service: application
detection:
  selection_endpoint:
    http.method: 'POST'
    http.url|contains: '/agents'
  selection_ids:
    - caller_project_id|exists: true
    - agent_id|exists: true
  condition: selection_endpoint and selection_ids
falsepositives:
  - Legitimate Agent moves performed by project owners
level: medium
tags:
  - attack.t1190
  - cwe.639
  - cve.2026.110851

YARA Rule

rule CVE_2026_110851_n8n_Agent_IDOR
{
    meta:
        author = "valtersit.com"
        description = "Detects references to n8n Agents endpoint abuse pattern (CWE-639)"
        cve = "CVE-2026-110851"
        date = "2026-01-01"
    strings:
        $ep1 = "/agents" ascii nocase
        $ep2 = "agents/create" ascii nocase
        $id1 = "agentId" ascii nocase
        $id2 = "projectId" ascii nocase
        $sch = "schema" ascii nocase
        $ver = "version" ascii nocase
    condition:
        any of ($ep*) and 2 of ($id*, $sch, $ver)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-110851 n8n Agent cross-project reassignment attempt"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"/agents"; http.request_body; content:"agentId"; http.request_body; content:"projectId"; http.request_body; content:"schema"; threshold:type both, track by_src, count 5, seconds 60; classtype:attempted-user; sid:2026110851; rev:1;)

Elastic Detection

sequence by user.name with maxspan=5m
  [http where http.request.method == "POST" and url.path : "*/agents*"]
  [http where http.request.method in ("POST","PUT") and url.path : "*/agents*" and
     http.request.body.text : "*agentId*" and
     http.request.body.text : "*projectId*" and
     not user.roles : "project:owner"]

Splunk SPL Query

index=n8n sourcetype=n8n:access OR sourcetype=n8n:audit
| search (uri_path="*/agents*" OR endpoint="/agents") http_method=POST
| rex field=request_body "\"agentId\"\s*:\s*\"(?<agent_id>[^\"]+)\""
| rex field=request_body "\"projectId\"\s*:\s*\"(?<caller_project>[^\"]+)\""
| where isnotnull(agent_id) AND isnotnull(caller_project)
| stats count values(caller_project) as projects values(agent_id) as agents by user src_ip
| where count > 3

Wazuh OSSEC Rule

<group name="n8n,web,">
  <rule id="110851" level="10">
    <decoded_as>json</decoded_as>
    <field name="http_method">POST</field>
    <field name="uri_path" type="pcre2">/agents</field>
    <field name="request_body" type="pcre2">"agentId".*"projectId"</field>
    <description>CVE-2026-110851: n8n Agent cross-project reassignment attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_110851,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 2/4 (CLAIMED) — a single advisory source (OSV) claims that n8n 2.41.4 and 2.42.1 address the issue, but this is not independently confirmed by a vendor advisory at the time of writing.

1. Immediate mitigations

   • Restrict network access to the n8n Agents API to trusted administrative networks.
   • Audit Agent ownership and project memberships; revoke read-only Agent access across projects unless strictly required.
   • Monitor audit logs for POST requests to /agents where the supplied Agent ID belongs to a project the caller does not own.
   • Enforce least-privilege roles; avoid granting any cross-project read visibility to non-owners.

2. Patch / upgrade steps

   • Upgrade n8n instances running any version below 2.41.4, and 2.42.x versions below 2.42.1, to the fixed releases.
   • Verify post-upgrade that the Agents endpoint performs an ownership check against the Agent's actual owning project.
   • Re-review recent Agent modifications to detect any that occurred without an authorized owner action.

3. Long-term hardening

   • Enforce object-level authorization (ownership checks) at the data access layer, not only at the endpoint boundary.
   • Adopt server-side, session-derived project scoping so caller-supplied IDs can never override ownership context.
   • Add automated authorization regression tests for all Agent and project mutation endpoints.
   • Deploy continuous monitoring for cross-project resource mutation patterns as a control against similar CWE-639 flaws.

References

1. NVD — https://nvd.nist.gov/vuln/detail/CVE-2026-110851
2. OSV — https://osv.dev/vulnerability/CVE-2026-110851 (patch claim source)
3. n8n official release notes / advisory channel for 2.41.4 and 2.42.1
4. CWE-639: Authorization Bypass Through User-Controlled Key — https://cwe.mitre.org/data/definitions/639.html
5. CISA KEV — Not listed at time of writing; no known in-the-wild exploitation reported.