CVE-2026-110846

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1

Description A signature bypass exists in the 'waiting-webhook' endpoint. The issue occurs because the system selects Send-and-Wait validation before normalizing an alternate node reference form. An attacker possessing an execution's resume token can approve waiting executions intended for other users, allowing downstream actions to run using the workflow owner's credentials, which may lead to command execution.

Recommendations Update n8n to version 2.41.4 or later. Update n8n to version 2.42.1 or later.