Signature Bypass in n8n Workflow Automation Software

CVE-2026-110846

What is CVE-2026-110846?

n8n versions before 2.41.4 and in 2.42.x up to 2.42.1 are affected by a signature bypass vulnerability within the waiting-webhook endpoint. This issue arises when sending Send-and-Wait validation without proper normalization of an alternative node reference form. If attackers gain control of a resume token from an execution, they may authorize waiting executions intended for different users, allowing them to trigger downstream actions under the legitimate workflow owner's credentials, which might include executing arbitrary commands.

References