CVE-2026-110841
CVE-2026-110841 · n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim's conversation.
CVSS 6.1 · Moyenne · EPSS 0,3% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
n8n
- Versions du logiciel
- ≥ 0, < 2.41.4: Concernée (semver)
Mettez à jour vers 2.41.4