Authorization Bypass Vulnerability in n8n Agent Chat Tool by n8n
CVE-2026-110841

6.1MEDIUM

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
14 October 2026

What is CVE-2026-110841?

The n8n platform versions prior to 2.41.4 and 2.42.0 have a significant vulnerability within the agent chat resume endpoint. This flaw allows authenticated project members to exploit the system by sending run identifiers without proper verification of the associated suspended checkpoint. Consequently, this enables unauthorized access to private agent conversations of other members within the same project scope. The misuse of this vulnerability facilitates the execution of tool calls and can lead to sensitive data exposure, thereby compromising the integrity of conversations.

Affected Version(s)

n8n 0 < 2.41.4

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-p3...
vendor-advisory
https://www.vulncheck.com/advisories/n8n-before-2.41.4-an...
third-party-advisory

CVSS V4

Score:
6.1
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

nlgbao1340
.