Listen to this Post
n8n is an open source workflow automation platform that allows users to connect various services and automate tasks through a visual workflow editor. The platform includes a Chat Trigger node that enables building chat interfaces, and a Form Trigger node that allows anonymous users to submit data to a workflow.
CVE-2026-86077 is a missing authorization vulnerability (CWE-862) affecting n8n versions prior to 2.37.7 and 2.38.2. The vulnerability resides in the `/chat` WebSocket route, which is used by the Chat Hub feature to handle interactive chat sessions. When a workflow execution is paused at an approval gate—such as a Send-and-Wait node, a non-chat Human-in-the-Loop (HITL) node, or a plain Wait node—the execution is suspended and a `resumeToken` is generated. This token is intended to be presented when the appropriate approval callback occurs, allowing the execution to resume.
The core flaw is that the `/chat` WebSocket route accepted any valid `resumeToken` and resumed the paused execution without verifying that the node being resumed was actually a chat-capable node. In other words, the authorization logic in packages/cli/src/chat/chat-execution-manager.ts, specifically the `canResumeOverChat` function, failed to gate the resume target based on node type. This means the chat route could be used to resume executions that were paused at non-chat approval gates.
The critical attack vector arises because n8n hands the `resumeToken` to anonymous form submitters. When a workflow uses a Form Trigger, any anonymous user who submits the form receives the resume token. An attacker with no account on the n8n instance can then present this token on the `/chat` WebSocket route. Since the chat route does not validate the node type, the attacker can release an execution that was waiting at an approval gate—the very control that workflow authors place in front of actions considered too consequential to automate. This effectively bypasses the human approval mechanism, allowing an unauthorized party to trigger downstream actions that were meant to require explicit authorization.
The patch for CVE-2026-86077 restricts resume operations over the chat route and Chat Hub to chat-capable node types only. This ensures that a `resumeToken` issued for a non-chat approval gate cannot be replayed through the chat interface.
DailyCVE Form:
Platform: n8n
Version: 2.37.7
Vulnerability: Authorization Bypass
Severity: Medium
date: 2026-09-08
Prediction: 2026-10-15
What Undercode Say:
The vulnerability can be analyzed through the following Bash commands and code snippets.
Enumerate n8n version:
curl -s http://target-n8n:5678/rest/settings | jq '.version'
Check for vulnerable version:
VERSION=$(curl -s http://target-n8n:5678/rest/settings | jq -r '.version') if [[ "$VERSION" < "2.37.7" ]]; then echo "[!] Vulnerable to CVE-2026-86077" fi
Relevant vulnerable code path (conceptual):
// packages/cli/src/chat/chat-execution-manager.ts
async canResumeOverChat(executionId: string, resumeToken: string): Promise<boolean> {
// VULNERABLE: does not validate node type
const execution = await this.executionRepository.findSingleExecution(executionId);
return execution.resumeToken === resumeToken;
}
Exploit: (Educational Purposes!)
An attacker with no n8n account can exploit this vulnerability by reusing a `resumeToken` obtained from an anonymous form submission on the `/chat` WebSocket route.
Step 1: Obtain resumeToken via Form Trigger. A workflow is configured with a Form Trigger followed by a Send-and-Wait approval gate. An attacker submits the form anonymously. The form submission response includes a resumeToken.
Step 2: Connect to /chat WebSocket. The attacker establishes a WebSocket connection to the `/chat` endpoint of the n8n instance, passing the `resumeToken` as a query parameter.
Step 3: Resume non-chat execution. The chat route accepts the token and resumes the paused execution without checking that the target node is a chat node. The Send-and-Wait approval gate is released, and the workflow continues to execute downstream actions that were intended to require human approval.
Protection:
Upgrade n8n to version 2.37.7 or 2.38.2 (or later). These versions restrict resume over the chat route and Chat Hub to chat-capable node types. If upgrading is not immediately possible, restrict n8n instance access to fully trusted users only. Avoid workflows that combine a Form Trigger with non-chat approval gates (Send-and-Wait, Telegram/Slack/Gmail HITL, or plain Wait nodes) on publicly accessible instances. Audit recent executions of such workflows for unexpected completion without a corresponding approval callback. Note that these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Impact:
An anonymous attacker with no account on the n8n instance can bypass human approval gates. The attacker can release an execution waiting at a Send-and-Wait, non-chat HITL, or Wait approval gate, causing the workflow to continue and perform actions that the workflow author explicitly intended to require manual authorization. This undermines the core control that prevents consequential automation from executing without human oversight. The CVSS 4.0 base score is 6.3, reflecting the missing authorization that enables the bypass.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
