HIGH 7.0 NVD
CVE-2026-110846
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalisin
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.
References
- https://github.com/n8n-io/n8n/security/advisories/GHSA-728h-pmr2-7cgh
- https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-send-and-wait-hmac-signa
This high severity vulnerability with a CVSS score of 7.0 was published on 2026-10-14 via NVD.
vulnfeed aggregates 15100 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.