n8n Cross-User Workflow ID and Lifecycle Event Disclosure

Technical Analysis

The `/rest/active-workflows` REST endpoint failed to apply a `userId` filter before returning the list of active workflow IDs, exposing them to any authenticated member regardless of sharing configuration. Additionally, server-to-client push events (workflow activation, deactivation, publication, and activation-error details) were broadcast globally over the shared connection channel rather than scoped to users with access to the affected workflow. An attacker with any valid account on a shared n8n instance could passively observe these broadcasts or query the endpoint to enumerate workflow IDs, version IDs, and error metadata belonging to other tenants, enabling reconnaissance for further targeted attacks (e.g., ID-based access attempts) even though workflow contents themselves were not directly exposed. This is a horizontal privilege escalation / broken object-level authorization issue rather than a direct code-execution or agent-hijack vector.

Affected Systems

n8n

Detection Signatures

• Unusual volume of requests to /rest/active-workflows from low-privileged accounts
• Push/websocket events containing workflow or version IDs not owned/shared with the receiving user session
• Multiple distinct user sessions receiving identical workflow lifecycle broadcasts
• Audit logs showing workflow ID enumeration patterns without corresponding sharing grants

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 1.123.76, 2.37.7, 2.38.2 or later, which scope both the active-workflows listing and push events through the sharing service.

2. 2

   Restrict instance access

   Until patched, limit n8n instance access to fully trusted users and avoid provisioning global:member accounts for untrusted or lower-trust users.

3. 3

   Audit exposure

   Review logs for evidence of cross-tenant workflow ID enumeration or unusual access to /rest/active-workflows prior to patching.

4. 4

   Enforce least privilege

   Apply strict sharing and role-based access controls to workflows, and periodically audit workflow sharing configurations post-patch.