CVE-2026-65014: n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
The DELETE /${restEndpoint}/test-webhook/:id route is registered before the authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow’s active test webhook registration.
The impact is limited to disrupting in-progress test sessions. Production webhooks, persistent workflow state, and stored data are not affected.
References
- github.com/advisories/GHSA-33q9-f52j-gc75
- github.com/n8n-io/n8n/releases/tag/n8n@2.27.4
- github.com/n8n-io/n8n/releases/tag/n8n@2.28.0
- github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75
- nvd.nist.gov/vuln/detail/CVE-2026-65014
- www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-test-webhook
Code Behaviors & Features
Detect and mitigate CVE-2026-65014 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →