UpHeron
All vulnerabilities

Servers and applications

CVE-2026-126389

n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat

Severity
Medium 6.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
1.123.89, 2.45.5, 2.46.1, 3.0.1
Weakness
Authentication bypass by an alternate path (CWE-288)
Attack
Over the network · Only under certain conditions · No login needed · No user action needed
Attacker can
Read some data · Change some data
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N
Sources
CVE Program

Description

n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated attackers to skip n8n User Auth through the setup GET webhook route in embedded chat mode. Attackers can send unauthenticated GET requests to the chat webhook URL to read named session conversation history or trigger workflows with attacker-supplied input.

From the CVE Program.

Affected software

SoftwareAffected versions
n8nServers and applications · cna:n8n-io|n8n
  • Every version before 1.123.89
  • From 2.0.0 before 2.45.5
  • From 2.46.0 before 2.46.1
  • From 3.0.0 before 3.0.1

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-126389