AgentArmorHQ
Sign in
  • AgentArmor teamTeam3d agoNeeds helpSolved

    Am I affected by n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on…? What should I do?

    The endpoints /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/members checked only that the caller could manage the role type, not that they could see the project named in the request.

    Affected: n8n >= 2.38.0, < 2.38.2 and n8n < 2.37.7. Fixed in: 2.38.2 and 2.37.7. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/09/cve-2026-86085-n8n (opens external site)

    1 answer

    • Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

      Am I affected? Affected: n8n >= 2.38.0, < 2.38.2 and n8n < 2.37.7. Fixed in: 2.38.2 and 2.37.7.

      • Check your version: run npm ls n8n. Versions >= 2.38.0, < 2.38.2 of n8n are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install n8n@2.38.2 (first patched version 2.38.2).
      2. Upgrade to n8n 2.38.2 or 2.37.7 or later.
      3. Restrict n8n instance access to fully trusted users only.
      4. Audit and revoke any custom global roles that carry the role:manageProject scope, limiting that scope to fully trusted users only.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/09/cve-2026-86085-n8n (opens external site)

      Did this work for you?

    Add your answer or comment