n8n Unauthenticated Test Webhook Cancellation via Missing Auth Middleware
First seen Jul 23, 2026 · Updated Jul 23, 2026
A REST endpoint in the n8n workflow automation platform is registered before authentication middleware is applied, letting any unauthenticated network caller cancel another user's active test webhook if they know the workflow ID. The impact is limited to disrupting in-progress test sessions; production webhooks and stored data are unaffected. This is a low-complexity availability/harassment issue rather than a data breach or compromise vector.
Technical Analysis
The route DELETE /${restEndpoint}/test-webhook/:id is mounted in the Express (or similar) router chain prior to the authentication middleware being applied, meaning requests reach the handler without passing identity or session checks. An attacker who can reach the n8n REST API network endpoint and guess or enumerate a workflow ID can send this DELETE request to terminate another user's active test webhook registration, causing denial of a legitimate testing workflow. This is a classic route-ordering/middleware misconfiguration bug rather than a logic flaw in agent reasoning; it does not expose stored credentials, workflow definitions, or persistent data, and does not affect production webhook triggers. Since n8n is frequently used to orchestrate AI agent pipelines and tool chains, disruption of test webhooks could interfere with agent development/testing workflows, but does not itself enable code execution or lateral movement.
Affected Systems
n8n
Detection Signatures
- Unauthenticated DELETE requests to /rest/test-webhook/:id or /${restEndpoint}/test-webhook/:id
- Repeated or anomalous DELETE calls to test-webhook endpoint from unauthenticated/unknown source IPs
- Workflow ID enumeration patterns in access logs targeting test-webhook routes
- Access to REST API test-webhook endpoints without corresponding valid session/auth tokens
Remediation Steps
- 1
Upgrade n8n
Update to n8n version 2.27.4 or later, which places the test-webhook DELETE route behind authentication middleware.
- 2
Restrict network access
Limit access to the n8n instance and its REST API to trusted internal networks or VPN until patched.
- 3
Deploy authenticating reverse proxy
Place the n8n instance behind a reverse proxy or firewall that enforces authentication before requests reach the REST API layer.
- 4
Monitor for abuse
Add logging/alerting on DELETE requests to test-webhook endpoints to detect exploitation attempts prior to patching.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.