CVE-2026-86077 in n8n
Summary
by MITRE • 09/09/2026
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the chat route to release a Send-and-Wait, non-chat HITL, or Wait approval gate. The affected authorization logic is packages/cli/src/chat/chat-execution-manager.ts, where canResumeOverChat did not gate the resume target. This issue is fixed in versions 2.37.7 and 2.38.2.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/09/2026
The vulnerability identified in n8n prior to versions 2.37.7 and 2.38.2 represents a critical authorization bypass within the platform's workflow execution engine, specifically affecting the human-in-the-loop interaction mechanisms. As an open-source workflow automation tool, n8n relies on complex state management to handle paused executions that require external input or approval before proceeding. The core flaw resides in the /chat WebSocket route implementation located in packages/cli/src/chat/chat-execution-manager.ts. This component is responsible for managing resume tokens associated with paused workflows, allowing users to provide necessary inputs to unblock automated processes. However, the logic governing these resumption events failed to validate whether the target node within the workflow was actually configured to accept chat-based interactions or human-in-the-loop approvals via this specific channel.
The technical mechanism of exploitation involves the misuse of resume tokens generated for non-chat scenarios. When a workflow pauses at a Send-and-Wait, a non-chat Human-In-The-Loop approval gate, or a Wait node that does not support direct chat messaging, n8n generates a unique resume token to allow authorized users to provide input and continue execution. Under normal circumstances, this token should only be valid for the specific interface intended by the workflow designer. However, due to the absence of validation in the canResumeOverChat function, an attacker who obtains such a token through any means could reuse it against the /chat WebSocket endpoint. This effectively bypasses the intended access controls and interaction methods defined by the workflow author, allowing unauthorized or unintended execution paths to be triggered via chat protocols rather than their designated interfaces.
The operational impact of this vulnerability is significant for organizations relying on n8n for sensitive automation tasks involving approvals or data submission. An anonymous form submitter who receives a resume token, potentially through social engineering, log exposure, or other information leakage vectors, can exploit the /chat route to release paused executions that were not designed for such interaction methods. This could lead to unauthorized workflow completions, where actions intended to be gated by specific approval processes are executed without proper verification. In security-critical workflows, this might result in data exfiltration, privilege escalation within connected systems, or disruption of business logic if the downstream nodes perform destructive operations based on inputs provided through an unintended channel. The lack of node-type validation fundamentally undermines the integrity of human-in-the-loop controls, which are often used as a primary defense mechanism against automated attacks or errors.
This vulnerability aligns with CWE-284 Improper Access Control and CWE-693 Protection Mechanism Failure, as it involves a failure to enforce intended access restrictions on functional components. From an ATT&CK perspective, the exploitation technique relates to T1505 Server Software Component which may be abused for persistence or execution control, although more directly it reflects flaws in authorization logic similar to those seen in various web application vulnerabilities where session tokens are misused across different endpoints. The remediation strategy is straightforward and has already been implemented by the n8n development team. Organizations running affected versions must upgrade immediately to version 2.37.7 or later, which includes a patch that ensures the resume logic correctly verifies whether the target node supports chat messages before allowing resumption via the /chat WebSocket route. Until this update is applied, administrators should monitor logs for unusual activity on the chat endpoint and restrict access to any exposed n8n instances using network-level controls such as firewalls or reverse proxies with strict authentication requirements to mitigate the risk of token exploitation by unauthorized parties.