CVE-2026-86077 n8n-io CVE debrief

Who should care

Defenders responsible for n8n instances should assess exposure and apply patches to prevent potential exploitation. This includes verifying the exposure of n8n instances to CVE-2026-86077 and applying patches to affected instances. Security teams and vulnerability management teams should also review the vulnerability and its potential impact on their systems.

Why it matters

CVE-2026-86077 allows anonymous form submitters to reuse resume tokens on the chat route, potentially releasing approval gates. Defenders should verify exposure and apply patches to affected n8n instances.

• Verify exposure of n8n instances to CVE-2026-86077
• Potential release of approval gates by anonymous form submitters
• Possible exploitation attempts on unpatched instances

Technical summary

The /chat WebSocket route in n8n accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the chat route to release a Send-and-Wait, non-chat HITL, or Wait approval gate. The affected authorization logic is packages/cli/src/chat/chat-execution-manager.ts, where canResumeOverChat did not gate the resume target. This issue is fixed in versions 2.37.7 and 2.38.2. Defenders should prioritize verifying exposure and applying patches to affected n8n instances.

Defensive priority

Defenders should prioritize verifying exposure and applying patches to affected n8n instances.

Recommended defensive actions

• Verify exposure of n8n instances to CVE-2026-86077
• Apply patches to affected n8n instances (versions prior to 2.37.7 or 2.38.2)
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed versions. The vulnerability allows anonymous form submitters to reuse resume tokens on the chat route, potentially releasing approval gates. Defenders should verify exposure and apply patches to affected n8n instances. Evidence is limited to public CVE and NVD records.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.