CVE-2026-110846

7.0 Élevée

Publiée le 15/10/2026 à 01:17 · Modifiée le 20/10/2026 à 05:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.

Traduire en français

Produits concernés

n8n-io n8n

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.0 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`

Faiblesses (CWE)

CWE-180

Références

https://github.com/n8n-io/n8n/security/advisories/GHSA-728h-pmr2-7cgh
https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-send-and-wait-hmac-signature-bypass-via-waiting-webhook

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories