CVE-2026-65014: n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook
(updated )
The DELETE /${restEndpoint}/test-webhook/:id route is registered before the authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow’s active test webhook registration.
The impact is limited to disrupting in-progress test sessions. Production webhooks, persistent workflow state, and stored data are not affected.
References
- github.com/advisories/GHSA-33q9-f52j-gc75
- github.com/n8n-io/n8n/releases/tag/n8n@2.27.4
- github.com/n8n-io/n8n/releases/tag/n8n@2.28.0
- github.com/n8n-io/n8n/security/advisories/GHSA-33q9-f52j-gc75
- nvd.nist.gov/vuln/detail/CVE-2026-65014
- www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-test-webhook
Code Behaviors & Features
Detect and mitigate CVE-2026-65014 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →