AI Threat AlertCVE-2026-118677: n8n Local Gateway: silent deep-link re-pairing
MEDIUMA missing confirmation step in the n8n Local Gateway desktop app lets a crafted n8n-computer-use:// link silently re-pair the user's computer to an attacker-controlled n8n instance. The new instance then inherits the permissions the user previously granted, so the attacker can act on the machine through the gateway. Exploitation needs user interaction and is rated high complexity (CVSS 5.9, medium). EPSS is not yet available, there is no public exploit, no Nuclei template and no KEV listing, so near-term mass exploitation looks unlikely. The impact is still higher than the score suggests: the gateway gives an AI agent control of a desktop, so a successful lure hands an attacker agent-level computer access. Upgrade the Local Gateway to n8n 2.41.4 or 2.42.1 or later, and until then block or restrict the n8n-computer-use:// URL handler and tell users not to open unsolicited links.
What is the risk?
Medium by CVSS (5.9), with exploitability limited by high attack complexity and required user interaction. Confidentiality impact is rated high because the attacker inherits granted gateway permissions. There is no known exploitation, no public PoC and no EPSS data, so likelihood is low today. Actual risk is higher for users who have given the gateway broad computer-use permissions (files, shell, browser, screen), since the damage depends on those grants. Targeted phishing against developers and automation operators is the most plausible route. Confidence: MEDIUM, because the details come only from the vendor advisory and VulnCheck.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade n8n and the Local Gateway to 2.41.4, 2.42.1 or later. 2) Until patched, quit the Local Gateway when not in use, or unregister or block the n8n-computer-use:// protocol handler through endpoint management (MDM/GPO). 3) Review and reduce permissions granted to the gateway, following least privilege. 4) Check the gateway's paired instance URL on managed endpoints and flag any that is not the corporate n8n host. 5) Monitor for the n8n-computer-use:// scheme launched from browsers, email clients or chat apps, and for new outbound connections from the gateway to unknown n8n hosts. 6) Train users to treat unexpected connect links as phishing.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-118677?
A missing confirmation step in the n8n Local Gateway desktop app lets a crafted n8n-computer-use:// link silently re-pair the user's computer to an attacker-controlled n8n instance. The new instance then inherits the permissions the user previously granted, so the attacker can act on the machine through the gateway. Exploitation needs user interaction and is rated high complexity (CVSS 5.9, medium). EPSS is not yet available, there is no public exploit, no Nuclei template and no KEV listing, so near-term mass exploitation looks unlikely. The impact is still higher than the score suggests: the gateway gives an AI agent control of a desktop, so a successful lure hands an attacker agent-level computer access. Upgrade the Local Gateway to n8n 2.41.4 or 2.42.1 or later, and until then block or restrict the n8n-computer-use:// URL handler and tell users not to open unsolicited links.
Is CVE-2026-118677 actively exploited?
No confirmed active exploitation of CVE-2026-118677 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-118677?
1) Upgrade n8n and the Local Gateway to 2.41.4, 2.42.1 or later. 2) Until patched, quit the Local Gateway when not in use, or unregister or block the n8n-computer-use:// protocol handler through endpoint management (MDM/GPO). 3) Review and reduce permissions granted to the gateway, following least privilege. 4) Check the gateway's paired instance URL on managed endpoints and flag any that is not the corporate n8n host. 5) Monitor for the n8n-computer-use:// scheme launched from browsers, email clients or chat apps, and for new outbound connections from the gateway to unknown n8n hosts. 6) Train users to treat unexpected connect links as phishing.
What systems are affected by CVE-2026-118677?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, computer-use agents, workflow automation platforms, desktop AI agent gateways.
What is the CVSS score for CVE-2026-118677?
CVE-2026-118677 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.17%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0011.003Malicious LinkAML.T0053AI Agent Tool InvocationAML.T0108AI AgentAML.T0112.000Local AI AgentCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently re-pair the app with a different n8n instance. Attackers can lure users running the Local Gateway into opening a crafted n8n-computer-use:// link to connect their computer to an attacker-controlled instance, inheriting previously granted permissions and acting on the computer through the gateway.
Exploitation Scenario
An attacker stands up their own n8n instance and builds an n8n-computer-use:// link pointing to it. They send the link by email or chat, or embed it in a web page, aimed at a developer who runs the Local Gateway. When the user clicks and the browser hands the link to the desktop app, the app re-pairs to the attacker's instance without asking for confirmation. The attacker then triggers computer-use workflows from their instance, reusing the existing permissions to read files, run actions in the user's session and exfiltrate data.
Weaknesses (CWE)
CWE-939Improper Authorization in Handler for Custom URL SchemePrimaryCWE-939Improper Authorization in Handler for Custom URL SchemeCWE-939 — Improper Authorization in Handler for Custom URL Scheme: The product uses a handler for a custom URL scheme, but it does not properly restrict which actors can invoke the handler using the scheme.
- [Architecture and Design] Utilize a user prompt pop-up to authorize potentially harmful actions such as those modifying data or dealing with sensitive information. When designing functionality of actions in the URL scheme, consider whether the action should be accessible to all mobile applications, or if an allowlist of applications to interface with is appropriate.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2025-686689.9n8n: Protection Bypass circumvents security controls
Same package: n8nCVE-2026-274959.9n8n: Code Injection enables RCE
Same package: n8n