PT-2026-146675

CVE-2026-126389

Published

2026-11-13

Updated

2026-11-13

Description by

CVSS 4.0

6.3

Medium

MetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.89

Description An authentication bypass exists in the Chat Trigger when used in embedded chat mode. Unauthenticated attackers can bypass n8n User Auth by sending GET requests to the setup webhook route. This allows the attacker to read named session conversation history or trigger workflows using attacker-supplied input.

Recommendations Update to version 1.123.89 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Masofgon

Vendors

Affected products

Weakness enumeration

CWE-288: Authentication Bypass Using an Alternate Path or Channel

Related identifiers