CVE-2026-126389: n8n Chat Trigger auth bypass

CISO Take

n8n before 1.123.89 has an authentication bypass in the Chat Trigger. An unauthenticated attacker can send GET requests to the embedded chat webhook's setup route and skip n8n User Auth. That lets them read named-session conversation history or fire workflows with input they control. The CVSS score is a moderate 5.4, because exploitation needs high attack complexity. Even so, the scope change matters: a triggered workflow can reach downstream systems, and chat transcripts may hold sensitive prompts or customer data. There is no KEV listing, no public exploit, no Nuclei template and no EPSS data yet, so near-term exploitation looks limited. Upgrade to n8n 1.123.89 or later. Until then, restrict network access to chat webhook URLs and review the chat-enabled workflows that hold privileged credentials.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

Moderate overall (CVSS 5.4). The flaw is network-reachable with no privileges and no user interaction, but high attack complexity limits reliability. The changed scope raises the impact, since an unauthenticated trigger can run workflows that touch connected systems and credentials. There is no known active exploitation (not in CISA KEV), no public PoC and no scanner template. Exposure is highest for internet-facing n8n instances that use embedded chat mode with User Auth as the only gate. Risk grows with the privileges of the workflows behind the chat trigger.

How does the attack unfold?

Initial Access

Attacker locates an internet-facing n8n embedded chat webhook URL.

AML.T0049

Authentication Bypass

Unauthenticated GET requests to the setup webhook route skip n8n User Auth in embedded chat mode.

AML.T0049

Collection / Execution

Attacker reads named-session conversation history and triggers workflows with attacker-supplied input.

AML.T0053

Impact

Chat data is exposed and attacker-driven workflow runs may reach connected systems and credentials.

Initial Access

Attacker locates an internet-facing n8n embedded chat webhook URL.

AML.T0049

Authentication Bypass

Unauthenticated GET requests to the setup webhook route skip n8n User Auth in embedded chat mode.

AML.T0049

Collection / Execution

Attacker reads named-session conversation history and triggers workflows with attacker-supplied input.

AML.T0053

Impact

Chat data is exposed and attacker-driven workflow runs may reach connected systems and credentials.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.8KOpenSSF 7.016 dependentsPushed 6d ago42% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRNone

UINone

SChanged

CLow

ILow

ANone

What should I do?

1 step

1) Upgrade n8n to 1.123.89 or later. 2) Until patched, remove public exposure of chat webhook URLs. Put them behind a reverse proxy, VPN or IP allowlist, or disable embedded chat mode. 3) Audit the workflows that use Chat Trigger and apply least privilege to their credentials and tool access. 4) Review access logs for unauthenticated GET requests to chat webhook setup routes, especially from unknown IPs or with unusual session names. 5) Check workflow execution history for runs not tied to authenticated users. 6) Rotate any secrets that may have appeared in exposed chat history. 7) Add rate limiting and alerting on webhook endpoints.

How is it classified?

Auth BypassData LeakageAgentFrameworkAPIAML.T0049- Exploit Public-Facing Application AML.T0053- AI Agent Tool Invocation AML.T0085- Data from AI Services

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated and documented

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-126389?

n8n before 1.123.89 has an authentication bypass in the Chat Trigger. An unauthenticated attacker can send GET requests to the embedded chat webhook's setup route and skip n8n User Auth. That lets them read named-session conversation history or fire workflows with input they control. The CVSS score is a moderate 5.4, because exploitation needs high attack complexity. Even so, the scope change matters: a triggered workflow can reach downstream systems, and chat transcripts may hold sensitive prompts or customer data. There is no KEV listing, no public exploit, no Nuclei template and no EPSS data yet, so near-term exploitation looks limited. Upgrade to n8n 1.123.89 or later. Until then, restrict network access to chat webhook URLs and review the chat-enabled workflows that hold privileged credentials.

Is CVE-2026-126389 actively exploited?

No confirmed active exploitation of CVE-2026-126389 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-126389?

1) Upgrade n8n to 1.123.89 or later. 2) Until patched, remove public exposure of chat webhook URLs. Put them behind a reverse proxy, VPN or IP allowlist, or disable embedded chat mode. 3) Audit the workflows that use Chat Trigger and apply least privilege to their credentials and tool access. 4) Review access logs for unauthenticated GET requests to chat webhook setup routes, especially from unknown IPs or with unusual session names. 5) Check workflow execution history for runs not tied to authenticated users. 6) Rotate any secrets that may have appeared in exposed chat history. 7) Add rate limiting and alerting on webhook endpoints.

What systems are affected by CVE-2026-126389?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Workflow automation platforms, Chatbot / conversational interfaces, LLM-orchestrated pipelines.

What is the CVSS score for CVE-2026-126389?

CVE-2026-126389 has a CVSS v3.1 base score of 5.4 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Agent frameworksWorkflow automation platformsChatbot / conversational interfacesLLM-orchestrated pipelines

MITRE ATLAS Techniques

AML.T0049Exploit Public-Facing Application

AML.T0053AI Agent Tool Invocation

AML.T0085Data from AI Services

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated attackers to skip n8n User Auth through the setup GET webhook route in embedded chat mode. Attackers can send unauthenticated GET requests to the chat webhook URL to read named session conversation history or trigger workflows with attacker-supplied input.

Exploitation Scenario

An attacker finds an internet-facing n8n instance with an embedded chat widget, for example a support bot. They send unauthenticated GET requests to the chat webhook URL and skip User Auth through the setup route. They guess or enumerate named session identifiers and read earlier conversations, which may include customer data or internal details. They then send crafted input to trigger the underlying workflow. That makes the AI agent run its connected tools, call external APIs or generate output that feeds other systems, all without credentials.

Weaknesses (CWE)

CWE-288Authentication Bypass Using an Alternate Path or ChannelPrimary CWE-288Authentication Bypass Using an Alternate Path or Channel

CWE-288 — Authentication Bypass Using an Alternate Path or Channel: The product requires authentication, but the product has an alternate path or channel that does not require authentication.

[Architecture and Design] Funnel all access through a single choke point to simplify how users can access a resource. For every access, perform a check to determine if the user has permissions to access the resource.

Source: MITRE CWE corpus.