CVE-2026-86077: n8n chat token replay bypasses HITL

Q: Is CVE-2026-86077 actively exploited?

No confirmed active exploitation of CVE-2026-86077 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-86077?

Upgrade n8n to 2.37.7 or 2.38.2 (or later), where canResumeOverChat now validates that the resume target actually supports chat-based resumption. As a workaround until patched, avoid exposing anonymous chat/form triggers on workflows that also contain sensitive Wait, Send-and-Wait, or other approval-gate nodes, and restrict who can reach the /chat WebSocket endpoint at the network/reverse-proxy layer. For detection, audit n8n execution logs for resumeToken reuse across unrelated executions or unexpected resumption of Wait/HITL nodes shortly after anonymous chat/form submissions, and review the GitHub Security Advisory GHSA-35jj-42hp-8gmq for IOC guidance.

Q: What systems are affected by CVE-2026-86077?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation, human-in-the-loop approval workflows.

Q: What is the CVSS score for CVE-2026-86077?

No CVSS score has been assigned yet.

CISO Take

n8n's /chat WebSocket endpoint accepted a resumeToken and resumed any paused workflow execution without verifying that the target node actually supported chat-based resumption, letting an anonymous form submitter reuse a token issued for one purpose to release a Send-and-Wait, Wait, or other non-chat human-in-the-loop approval gate elsewhere in the workflow. For CISOs running n8n as an orchestration layer around AI agents, this is a human-oversight control failure disguised as a low-severity bug: any workflow relying on a manual approval step (e.g., 'require human sign-off before the agent sends an email, executes a payment, or calls an external API') could have that gate silently released by an unauthenticated party who merely submitted a public form. There is no CVSS score, EPSS data, KEV listing, or public exploit/scanner coverage, so opportunistic mass exploitation is unlikely today, but the flaw is trivially reachable by anyone who receives a legitimate chat/form token. Patch to n8n 2.37.7 or 2.38.2 immediately, and in the interim audit any workflow that mixes public-facing chat/form triggers with Wait or Send-and-Wait approval nodes for unexpected resume events in execution logs.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Medium severity per vendor advisory, driven by a missing authorization check (CWE-862) in packages/cli/src/chat/chat-execution-manager.ts (canResumeOverChat). Exploitability is low-complexity and requires no privileges beyond possessing a resumeToken issued through a legitimate anonymous channel (public form submission), meaning attacker skill required is low-to-moderate — the attacker must understand n8n's execution/resume model but needs no credentials. Impact is scoped to workflow logic integrity: it lets an outsider release approval/wait gates they were never authorized to release, potentially triggering downstream actions (agent tool calls, notifications, data writes) prematurely or without the intended human sign-off. No evidence of active exploitation, no CISA KEV listing, no public PoC or Nuclei template — exposure is currently theoretical but real for any org exposing n8n chat/form triggers publicly.

How does the attack unfold?

Initial Access

Adversary submits a public-facing n8n chat/form trigger anonymously and receives a legitimate resumeToken for that specific execution.

AML.T0049

Authorization Bypass

Adversary replays the resumeToken against the /chat WebSocket route, targeting a different, unrelated paused execution (a Send-and-Wait or Wait HITL node) that never checked whether the token's origin was authorized for that target.

AML.T0091.000

Impact

The approval-gated execution resumes as if a human had approved it, allowing the agent workflow's gated action (e.g., sending communications, executing a downstream task) to proceed without legitimate human sign-off.

Initial Access

Adversary submits a public-facing n8n chat/form trigger anonymously and receives a legitimate resumeToken for that specific execution.

AML.T0049

Authorization Bypass

Adversary replays the resumeToken against the /chat WebSocket route, targeting a different, unrelated paused execution (a Send-and-Wait or Wait HITL node) that never checked whether the token's origin was authorized for that target.

AML.T0091.000

Impact

The approval-gated execution resumes as if a human had approved it, allowing the agent workflow's gated action (e.g., sending communications, executing a downstream task) to proceed without legitimate human sign-off.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	>= 2.38.0, < 2.38.2	`2.38.2`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade n8n to 2.37.7 or 2.38.2 (or later), where canResumeOverChat now validates that the resume target actually supports chat-based resumption. As a workaround until patched, avoid exposing anonymous chat/form triggers on workflows that also contain sensitive Wait, Send-and-Wait, or other approval-gate nodes, and restrict who can reach the /chat WebSocket endpoint at the network/reverse-proxy layer. For detection, audit n8n execution logs for resumeToken reuse across unrelated executions or unexpected resumption of Wait/HITL nodes shortly after anonymous chat/form submissions, and review the GitHub Security Advisory GHSA-35jj-42hp-8gmq for IOC guidance.

How is it classified?

Auth Bypass Agent AML.T0049 - Exploit Public-Facing Application AML.T0091.000 - Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 14 - Human Oversight

ISO 42001

A.9 - AI system operation and monitoring / human oversight

NIST AI RMF

GOVERN 4.1 / MANAGE 1.1 - Human oversight and accountability mechanisms

OWASP LLM Top 10

LLM08 - Excessive Agency

Frequently Asked Questions

What is CVE-2026-86077?

n8n's /chat WebSocket endpoint accepted a resumeToken and resumed any paused workflow execution without verifying that the target node actually supported chat-based resumption, letting an anonymous form submitter reuse a token issued for one purpose to release a Send-and-Wait, Wait, or other non-chat human-in-the-loop approval gate elsewhere in the workflow. For CISOs running n8n as an orchestration layer around AI agents, this is a human-oversight control failure disguised as a low-severity bug: any workflow relying on a manual approval step (e.g., 'require human sign-off before the agent sends an email, executes a payment, or calls an external API') could have that gate silently released by an unauthenticated party who merely submitted a public form. There is no CVSS score, EPSS data, KEV listing, or public exploit/scanner coverage, so opportunistic mass exploitation is unlikely today, but the flaw is trivially reachable by anyone who receives a legitimate chat/form token. Patch to n8n 2.37.7 or 2.38.2 immediately, and in the interim audit any workflow that mixes public-facing chat/form triggers with Wait or Send-and-Wait approval nodes for unexpected resume events in execution logs.

Is CVE-2026-86077 actively exploited?

No confirmed active exploitation of CVE-2026-86077 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-86077?

Upgrade n8n to 2.37.7 or 2.38.2 (or later), where canResumeOverChat now validates that the resume target actually supports chat-based resumption. As a workaround until patched, avoid exposing anonymous chat/form triggers on workflows that also contain sensitive Wait, Send-and-Wait, or other approval-gate nodes, and restrict who can reach the /chat WebSocket endpoint at the network/reverse-proxy layer. For detection, audit n8n execution logs for resumeToken reuse across unrelated executions or unexpected resumption of Wait/HITL nodes shortly after anonymous chat/form submissions, and review the GitHub Security Advisory GHSA-35jj-42hp-8gmq for IOC guidance.

What systems are affected by CVE-2026-86077?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation, human-in-the-loop approval workflows.

What is the CVSS score for CVE-2026-86077?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow automationhuman-in-the-loop approval workflows

MITRE ATLAS Techniques

AML.T0049 Exploit Public-Facing Application

AML.T0091.000 Application Access Token

Compliance Controls Affected

EU AI Act: Article 14

ISO 42001: A.9

NIST AI RMF: GOVERN 4.1 / MANAGE 1.1

OWASP LLM Top 10: LLM08

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the chat route to release a Send-and-Wait, non-chat HITL, or Wait approval gate. The affected authorization logic is packages/cli/src/chat/chat-execution-manager.ts, where canResumeOverChat did not gate the resume target. This issue is fixed in versions 2.37.7 and 2.38.2.

Exploitation Scenario

An organization runs an n8n workflow where a public-facing contact form triggers a chat-enabled node (issuing the submitter a resumeToken to continue the conversation), while a separate, sensitive branch of the same or another workflow uses a Send-and-Wait node requiring a human employee to approve an AI agent's proposed action (e.g., approving an agent-drafted refund or an automated account change). The anonymous form submitter takes the resumeToken they legitimately received from the chat interaction and replays it against the /chat WebSocket route, but points it at the Send-and-Wait execution instead. Because canResumeOverChat didn't verify the target node supported chat resumption, the paused execution resumes as if a human had approved it — releasing the agent's action without any actual sign-off, all without the attacker ever authenticating.

Weaknesses (CWE)

CWE-862 Missing Authorization Primary CWE-862 Missing Authorization Primary CWE-862 Missing Authorization

CWE-862 — Missing Authorization: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.