CVE-2026-110846

n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

State: Published
Severity: 7.0 High
Published: Oct 14, 2026
Updated: Oct 20, 2026
Reserved: Oct 14, 2026

Description

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.

Scores

CVSS	Score	Vector	Source
4.0	7.0 High	CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N	VulnCheck

Weaknesses

CWE-180 Incorrect Behavior Order: Validate Before Canonicalize

Affected Products

Product	Versions
n8nn8n-io	before 2.41.4Affected 2.42.0 to before 2.42.1Affected

References

GitHub Security Advisory (GHSA-728h-pmr2-7cgh)vendor-advisory
VulnCheck Advisory: n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhookthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.