CVE-2026-118677

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.4 n8n versions 2.42.x prior to 2.42.1

Description The Local Gateway desktop app contains a flaw in its deep-link connect handler that fails to require user confirmation. This allows the application to be silently re-paired with a different n8n instance. An attacker can use a crafted n8n-computer-use:// link to connect the user's computer to an instance under the attacker's control, allowing the attacker to inherit previously granted permissions and execute actions on the computer via the gateway.

Recommendations Update n8n to version 2.41.4 or later. Update n8n versions 2.42.x to 2.42.1 or later.