CVE-2026-110846: n8n: Send-and-Wait signature bypass enables forged approvals

n8n before 2.41.4 and 2.42.x before 2.42.1 has a flaw in its waiting-webhook endpoint. It picks Send-and-Wait HMAC validation before it normalises an alternate node reference form, so an attacker who holds an execution's resume token can approve waiting executions meant for someone else. Approved executions run downstream actions under the workflow owner's credentials, which may include command execution, so human-in-the-loop approval gates for AI agent workflows can be bypassed. The record has no CVSS or EPSS score yet. It is not in CISA KEV, and no public exploit or Nuclei template is listed. Exploitation needs a leaked or guessed resume token, which limits likelihood, but the impact on agentic automations is high. Upgrade to 2.41.4 or 2.42.1 or later, and review which workflows use Send-and-Wait approvals to gate privileged actions.

No confirmed active exploitation of CVE-2026-110846 has been reported, but organizations should still patch proactively.

1) Upgrade n8n to 2.41.4 or 2.42.1 or later. 2) Until patched, restrict network access to the waiting-webhook endpoint (for example by IP allowlist or VPN, or by blocking external access at the reverse proxy). 3) Treat resume URLs and tokens as secrets: avoid posting them to shared channels, tickets or logs, and rotate pending ones where possible. 4) Inventory workflows that use Send-and-Wait and remove or tighten the privileges behind them, using least-privilege credentials and avoiding command-execution nodes. 5) Detect: review webhook-waiting requests and execution logs for approvals from unexpected IPs, with unusual timing, or with no matching approver activity. 6) Rotate credentials used by workflows that may have been approved by an attacker.

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation, human-in-the-loop approval pipelines, LLM tool orchestration.

No CVSS score has been assigned yet.