CVE-2026-110846 n8n-io CVE debrief

Who should care

Defenders and administrators of n8n deployments, especially those using versions before 2.41.4 and 2.42.1, should assess potential exposure and impacts on workflow owners' credentials.

Why it matters

Defenders should prioritize verifying exposure in n8n deployments, especially those using versions before 2.41.4 and 2.42.1, and assess potential impacts on workflow owners' credentials due to the signature bypass vulnerability in the waiting-webhook endpoint.

• Potential unauthorized workflow execution under workflow owner's credentials
• Possible lateral movement within workflows
• Required verification of n8n version and exposure
• Potential impact on workflow validation and security

Technical summary

n8n before 2.41.4 and 2.42.1 contains a signature bypass in the waiting-webhook endpoint, allowing attackers with an execution's resume token to approve waiting executions meant for others, potentially running downstream actions under the workflow owner's credentials. The vulnerability selects Send-and-Wait validation before normalising an alternate node reference form. This could enable unauthorized workflow execution under workflow owner's credentials and possible lateral movement within workflows. Defenders should prioritize verifying exposure in n8n deployments, especially those using versions before 2.41.4 and 2.42.1.

Defensive priority

Defenders should prioritize verifying exposure in n8n deployments, especially those using versions before 2.41.4 and 2.42.1, and assess potential impacts on workflow owners' credentials.

Recommended defensive actions

• Verify n8n version and assess exposure
• Review workflow configurations and credentials
• Implement compensating controls for workflow validation
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record and source item provide details on the signature bypass vulnerability in n8n's waiting-webhook endpoint. However, limited information is available on potential exploitation or specific impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.