WebSocket Vulnerability in n8n Workflow Automation Platform
CVE-2026-86077

6.3MEDIUM

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
8 September 2026

What is CVE-2026-86077?

The n8n workflow automation platform had a vulnerability affecting its /chat WebSocket route. Prior to versions 2.37.7 and 2.38.2, the system accepted a resumeToken without proper validation of the target node's capability to process chat messages. This flaw allowed an unauthorized user, equipped with a valid resumeToken from an anonymous submission, to inadvertently activate actions on non-chat nodes, such as Send-and-Wait or Wait approval processes. The problematic authorization logic, located in packages/cli/src/chat/chat-execution-manager.ts, failed to restrict the resume targets effectively, leading to potential misuse. This issue was rectified in the subsequent software releases.

Affected Version(s)

n8n < 2.37.7 < 2.37.7

n8n >= 2.38.0, < 2.38.2 < 2.38.0, 2.38.2

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-35...
x_refsource_CONFIRM
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
x_refsource_MISC
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.