CVE-2026-103260 in n8n
Summary
by MITRE • 10/01/2026
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advance waiting executions and trigger guarded actions.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/01/2026
The n8n automation platform, specifically versions prior to 2.39.6 in the 2.39.x series and prior to 2.40.1 in the 2.40.x series, contains a critical logic flaw within its workflow execution engine that undermines security controls designed for human-in-the-loop processes. This vulnerability is located specifically in the Send and Wait node when operating under the Approve Within Chat mode configuration. The core technical failure involves an insufficient verification mechanism during the resume request phase of a paused workflow execution. When a workflow reaches this node, it typically pauses to await external input or approval before proceeding with sensitive operations such as financial transactions, data deletion, or system configuration changes. In a properly secured implementation, any attempt to resume or approve this waiting state must rigorously validate that the entity submitting the request possesses both valid authentication credentials and explicit authorization permissions for that specific workflow instance. However, in these affected versions of n8n, the backend logic fails to enforce this identity check against the approval permission requirements.
This architectural oversight allows unauthenticated actors or malicious users with limited privileges to bypass the intended security gate by directly submitting resume requests to the API endpoint associated with the waiting node. Because the system does not verify that the requester is the same entity originally authorized to approve the action, nor does it confirm their identity through standard authentication protocols during this specific interaction, an attacker can manipulate the workflow state without proper oversight. This effectively neutralizes the purpose of the approval step, transforming a controlled checkpoint into an open command channel. The flaw represents a classic case of broken access control where the system trusts the input source implicitly rather than validating it against established security policies.
The operational impact of this vulnerability is severe for organizations relying on n8n to automate critical business processes that require human verification. By exploiting this bypass, attackers can trigger guarded actions that were intended to be protected by manual approval workflows. This could lead to unauthorized data exfiltration, accidental deletion of important records, execution of malicious scripts, or manipulation of connected third-party services such as databases, cloud storage accounts, or enterprise resource planning systems. Since n8n is often used in integration-heavy environments where it holds elevated privileges across multiple endpoints, the ability to execute these actions without approval can result in significant data breaches, financial loss, and disruption of business continuity. The lack of identity verification means that even users with minimal platform access could potentially escalate their impact by manipulating workflow states they should not be able to influence.
From a classification perspective, this vulnerability aligns closely with CWE-284 Improper Access Control, as the system fails to restrict actions based on user roles and permissions during the approval process. It also maps to MITRE ATT&CK technique T1078 Valid Accounts if exploited by authenticated users with insufficient privileges, or potentially T1565 Data Manipulation if the result involves altering stored data through automated workflows. To mitigate this risk, organizations running affected versions of n8n must immediately upgrade to version 2.39.6 or later for the legacy branch and version 2.40.1 or later for the current stable release. These updates contain patches that enforce strict identity verification and permission checks before allowing any resume requests to proceed. Until an upgrade is performed, administrators should consider restricting network access to n8n instances behind strong authentication proxies and auditing workflow configurations to ensure no critical automation relies solely on unverified chat-based approvals without additional backend safeguards.