PT-2026-36900 · N8N · N8N

34Selen · Published 2026-04-22 · Updated 2026-05-05 · CVE-2026-42228

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.32 n8n versions prior to 2.17.4 n8n versions prior to 2.18.1

Description The '/chat' WebSocket endpoint used by the Chat Trigger node's Hosted Chat feature fails to verify if an incoming connection is authorized to interact with the target execution. An unauthenticated remote attacker who identifies a valid execution ID for a workflow in a waiting state can attach to that execution, receive the pending prompt intended for the legitimate user, and submit arbitrary input to resume or influence downstream workflow behavior.

Recommendations Update to version 1.123.32. Update to version 2.17.4. Update to version 2.18.1.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-06921

CVE-2026-42228

GHSA-F77H-J2V7-G6MW

Affected Products

N8N

References · 10

• 🔥 https://github.com/rudSarkar/CVE-2026-42228 · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-f77h-j2v7-g6mw · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42228 · Security Note
• https://bdu.fstec.ru/vul/2026-06921 · Security Note
• https://osv.dev/vulnerability/GHSA-f77h-j2v7-g6mw · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/infoflowcloud/status/2051385408840237458 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051539325989314971 · Twitter Post
• https://t.me/cveNotify/162077 · Telegram Post
• https://twitter.com/CVEnew/status/2051383977118756912 · Twitter Post