CVE-2026-42228

medium

n8n is an open source workflow automation platform.

Vendor / product: N8n — n8n

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /chat WebSocket endpoint used by the Chat Trigger node's Hosted Chat feature did not verify that an incoming connection was authorized to interact with the target execution. An unauthenticated remote attacker who could identify a valid execution ID for a workflow in a waiting state could attach to that execution, receive the pending prompt intended for the legitimate user, and submit arbitrary input to resume or influence downstream workflow behavior. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

CVSS

6.5

6.5 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Severity source: NVD CVSS v3.1 (nvd@nist.gov)

Timeline (UTC)

Published: 2026-05-04 19:16

Modified: 2026-11-11 23:10

NVD status: Analyzed

Last synced 3 hours ago

Verified against the source API 2026-11-11 23:13 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

n8n / n8n <1.123.32, ≥2.17.0 <2.17.4, 2.18.0

Weakness classification (CWE)

CWE-862

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://github.com/n8n-io/n8n/security/advisories/GHSA-f77h-j2v7-g6mw

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-f77h-j2v7-g6mw security-advisories@github.com

Data sources

NVD CVE API 2.0 — fetched 2026-11-11 23:13 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-42228

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs