CyberRota Analysis
AI-GeneratedThe n8n workflow automation platform prior to versions 1.123.76, 2.37.7, and 2.38.2 exposes sensitive information through the /rest/active-workflows endpoint, allowing unauthorized users to access active workflow IDs and related events. This vulnerability could lead to information disclosure, potentially enabling attackers to exploit workflow details. Organizations using affected versions should prioritize upgrading to the patched releases to mitigate the risk of unauthorized access to workflow information.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow ID on the instance to any member regardless of sharing. Workflow activation, deactivation, and publication push events were also broadcast to clients that could not access the affected workflow, disclosing workflow IDs, version IDs, and activation error details. The affected paths include packages/cli/src/services/active-workflows.service.ts and packages/cli/src/workflows/workflow-push-notifier.service.ts. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Related CVEs
Other vulnerabilities affecting the same vendor(s)