GHSA-f77h-j2v7-g6mw: n8n Vulnerable to Hijacking of Unauthenticated Chat Execution

Summary

The `/chat` WebSocket endpoint used by n8n's Chat Trigger node did not verify that incoming connections were authorized for the target execution. An unauthenticated remote attacker who could identify a valid execution ID for a workflow in a waiting state could attach to that execution, receive the pending prompt meant for the legitimate user, and submit arbitrary input to resume or influence downstream workflow behavior. Exploitation requires a public Hosted Chat workflow with authentication set to `None`, a target execution in a waiting state, and knowledge of that execution ID.

Mitigation

Fixed in n8n versions 1.123.32, 2.17.4, and 2.18.1; upgrade to one of these or later. Temporary workaround if upgrading is not immediately possible: set the Authentication field on all Chat Trigger nodes to `n8n User Auth` rather than `None`. The source states this workaround does not fully remediate the risk and should only be used as a short-term measure.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmLLM dependency since 2026-02-10

Related items

• HighCVE-2026-123818: LMDeploy is a toolkit for compressing, deploying, and serving large language models. From 0.12.3 until 0.15.0…Similar attack · NVD/CVE Database
• HighGHSA-vvr2-h2jp-838m: Code Graph RAG: MCP paginated read_file path traversal / arbitrary file readSimilar attack · GitHub Advisory Database
• MediumAttackers Crash Claude's 'Office Party' Flaw to Run Malicious Code on LinuxSimilar attack · Dark Reading
• MediumCVE-2026-124588: huggingface finetrainers code injection via Library argumentSimilar attack · NVD/CVE Database
• MediumTaiwan-Based Hacker Used BOSSAI AI Agents to Steal Taipei Emergency Dispatch RecordsSimilar attack · The Hacker News