CVE-2026-110841: n8n: IDOR in agent chat resume exposes conversations

MEDIUMCISA: TRACK*

Published October 14, 2026

CISO Take

n8n versions before 2.41.4 and 2.42.0 have an authorization bypass in the agent chat resume endpoint. It accepts a run identifier from the request body without checking that the suspended checkpoint belongs to the caller. Any authenticated project member can read other members' private agent conversations and approve their pending tool calls, which then execute and write results into the victim's conversation. This defeats the human-in-the-loop approval control that organizations rely on to constrain agent actions. Severity, CVSS and EPSS are not yet scored, and there is no KEV listing, public exploit or Nuclei template. Exploitation needs only a low-privilege account, so insider and shared-project risk is real. Upgrade to 2.41.4 or 2.42.0 or later, then review agent tool-call approval logs for approvals made by someone other than the conversation owner.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Risk is moderate to high for multi-user n8n deployments with shared projects. No CVSS or EPSS score is published yet, and the flaw is not in CISA KEV with no known public exploit. It requires authentication as a project member, but no user interaction and likely low complexity, because the attacker only needs to supply a run identifier. Impact covers confidentiality (reading private conversations that may contain sensitive data or credentials) and integrity (approving and executing pending tool calls with the victim's context and connected credentials). Single-user or tightly controlled instances are much less exposed.

How does the attack unfold?

Initial Access

Attacker authenticates as a legitimate member of a shared n8n project.

AML.T0012

Discovery

Attacker lists project-scoped endpoints to read other members' private agent conversations and find pending tool calls.

AML.T0085.001

Exploitation

Attacker submits the victim's run identifier to the chat resume endpoint, which skips the ownership check on the suspended checkpoint.

AML.T0053

Impact

The victim's pending tool calls execute with their context and credentials, and results are written into their conversation.

Initial Access

Attacker authenticates as a legitimate member of a shared n8n project.

AML.T0012

Discovery

Attacker lists project-scoped endpoints to read other members' private agent conversations and find pending tool calls.

AML.T0085.001

Exploitation

Attacker submits the victim's run identifier to the chat resume endpoint, which skips the ownership check on the suspended checkpoint.

AML.T0053

Impact

The victim's pending tool calls execute with their context and credentials, and results are written into their conversation.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 21% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

1) Upgrade n8n to 2.41.4 or 2.42.0 or later. 2) Until patched, limit project membership to trusted users and remove unnecessary members. 3) Restrict agent tools that perform write or destructive actions, or disable tool-approval workflows on shared projects. 4) Rotate credentials and secrets that may have appeared in agent conversations or been used by approved tools if misuse is suspected. 5) Detection: review n8n execution and audit logs, and reverse-proxy logs, for requests to the agent chat resume endpoint where the run identifier belongs to a different user, and for tool executions approved by a user other than the conversation owner. Alert on enumeration of project-scoped conversation endpoints by non-owners. 6) Review the vendor advisory GHSA-p3pg-xw4f-m72c.

What does CISA's SSVC say?

DecisionTrack*

Exploitationnone

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAgentFrameworkAML.T0012- Valid Accounts AML.T0053- AI Agent Tool Invocation AML.T0080.001- Thread AML.T0085.001- AI Agent Tools

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 14-Human oversight

ISO 42001

A.9.2-Processes for responsible use of AI systems

NIST AI RMF

GOVERN 1.4-Risk management process and controls are established and documented

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-110841?

Is CVE-2026-110841 actively exploited?

No confirmed active exploitation of CVE-2026-110841 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-110841?

1) Upgrade n8n to 2.41.4 or 2.42.0 or later. 2) Until patched, limit project membership to trusted users and remove unnecessary members. 3) Restrict agent tools that perform write or destructive actions, or disable tool-approval workflows on shared projects. 4) Rotate credentials and secrets that may have appeared in agent conversations or been used by approved tools if misuse is suspected. 5) Detection: review n8n execution and audit logs, and reverse-proxy logs, for requests to the agent chat resume endpoint where the run identifier belongs to a different user, and for tool executions approved by a user other than the conversation owner. Alert on enumeration of project-scoped conversation endpoints by non-owners. 6) Review the vendor advisory GHSA-p3pg-xw4f-m72c.

What systems are affected by CVE-2026-110841?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, human-in-the-loop tool approval, multi-tenant AI agent deployments.

What is the CVSS score for CVE-2026-110841?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automation platformshuman-in-the-loop tool approvalmulti-tenant AI agent deployments

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0053AI Agent Tool Invocation

AML.T0080.001Thread

AML.T0085.001AI Agent Tools

Compliance Controls Affected

EU AI Act: Art. 14

ISO 42001: A.9.2

NIST AI RMF: GOVERN 1.4

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent conversations through project-scoped endpoints, then approve their pending tool calls, causing the tools to execute and write results into the victim's conversation.

Exploitation Scenario

A contractor with member access to a shared n8n project lists the project-scoped agent conversation endpoints and finds a finance analyst's private agent session, which contains a pending tool call to send a payment-related email through a connected account. The contractor reads the conversation to learn context, then calls the chat resume endpoint with the analyst's run identifier in the request body. The server does not verify ownership of the checkpoint, so the pending tool call is approved and executes with the workflow's credentials. The result is written into the analyst's conversation, where it looks like a normal agent action.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.