CVE-2026-110841 in n8n
Summary
by MITRE • 10/15/2026
n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim's conversation.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in n8n versions prior to 2.41.4 and version 2.42.0 represents a critical authorization bypass within the agent chat resume endpoint. This flaw stems from an insufficient verification of ownership for suspended checkpoints during the resumption process. When a client requests to resume a previously paused execution by providing a run identifier in the request body, the server fails to validate that this specific checkpoint is associated with the authenticated user making the request. Instead, the system relies solely on the presence of a valid session token or authentication cookie without cross-referencing it against the ownership metadata of the workflow state being resumed. This architectural oversight allows any authenticated member within a shared project workspace to manipulate execution states belonging to other members, effectively bypassing intended access controls and leading to unauthorized actions.
The operational impact of this vulnerability is severe due to its potential for data exfiltration and integrity compromise within collaborative environments. An attacker who has gained valid authentication credentials as a member of the same n8n project can enumerate available workflows or agent conversations through public-facing endpoints that list run identifiers. By analyzing these lists, the attacker identifies suspended checkpoints belonging to other users. The attacker then submits a resume request for one of these foreign checkpoints. Because the server does not verify ownership, it proceeds with resuming the execution under the context of the victim user. This allows the attacker to approve pending tool calls that were originally initiated by the victim but left in a waiting state. Consequently, tools execute as if authorized by the victim, and their results are written directly into the victim's conversation history or workflow output, potentially exposing sensitive data processed during those operations.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically highlighting failures in verifying user identity for specific resources. Furthermore, it maps to MITRE ATT&CK technique T1078, Valid Accounts, as the exploitation requires legitimate credentials but abuses them to access unauthorized data and perform actions outside their intended scope. The scenario also reflects aspects of CWE-639, Authorization Bypass Through User-Controlled Key, where the run identifier serves as a user-controlled key that is not properly validated against session context. In enterprise settings using n8n for automated workflows involving sensitive integrations such as databases or external APIs, this flaw could lead to significant data breaches if those tools have broad permissions and process confidential information belonging to other team members.
Mitigation strategies must prioritize immediate version upgrades and strict access control reviews. Organizations running affected versions of n8n should upgrade to version 2.41.4 or later, where the authorization logic for the agent chat resume endpoint has been corrected to enforce ownership verification. Until an upgrade is feasible, administrators can implement network-level controls such as Web Application Firewalls (WAF) that inspect request payloads for patterns indicative of cross-user checkpoint resumption attempts, although this is a less robust defense than patching the application code. Additionally, reviewing project membership and limiting who has access to sensitive workflows can reduce the attack surface. It is also recommended to audit logs for unusual resume activity involving checkpoints not initiated by the requesting user account to detect potential exploitation in real-time.