n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test Webhook

MediumCVE-2026-65014 · Published Jul 22, 2026

## Impact The `DELETE /${restEndpoint}/test-webhook/:id` route is registered before the authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to cancel that workflow's active test webhook registration. The impact is limited to disrupting in-progress test sessions. Production webhooks, persistent workflow state, and stored data are not affected. ## Patches Users should upgrade to the patched version once available to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict network access to the n8n instance to fully trusted users only. - Place the n8n instance behind a reverse proxy or firewall that requires authentication before reaching the REST API. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.