Description
n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on the Chat Trigger webhook endpoint can be circumvented, allowing access without valid credentials. Fixed in 1.123.22, 2.9.3, and 2.10.1.
References (2)
Core 2
Core References
Vendor Advisory vendor-advisory
GitHub Security Advisory (GHSA-jh8h-6c9q-7gmw)
https://github.com/n8n-io/n8n/security/advisories/GHSA-jh8h-6c9q-7gmw
Third Party Advisory third-party-advisory
VulnCheck Advisory: n8n - Authentication Bypass in Chat Trigger Node
https://www.vulncheck.com/advisories/n8n-authentication-bypass-in-chat-trigger-node
Scores
CVSS v3
4.8
EPSS
0.0023
EPSS Percentile
14.1%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CISA SSVC
Vulnrichment
Exploitation
none
Automatable
no
Technical Impact
partial
Details
CWE
CWE-287
Status
published
Products (7)
n8n/n8n
2.10.0 (2 CPE variants)
n8n/n8n
< 1.123.22 (2 CPE variants)
n8n/n8n
1.123.22
n8n/n8n
2.0.0 - 2.9.3
n8n/n8n
2.10.0 - 2.10.1
n8n/n8n
2.10.1
n8n/n8n
2.9.3
Published
Jul 15, 2026
Tracked Since
Jul 15, 2026