CVE-2026-126389
Deferred Deferred - Pending Action

Authentication Bypass in n8n Chat Trigger via Unauthenticated GET Requests

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated attackers to skip n8n User Auth through the setup GET webhook route in embedded chat mode. Attackers can send unauthenticated GET requests to the chat webhook URL to read named session conversation history or trigger workflows with attacker-supplied input.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-126389
EUVD
EUVD-2026-125176

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
n8n n8n 1.123.89
n8n n8n to 1.123.89 (exc)
n8n n8n From 2.0.0 (inc) to 2.45.5 (inc)
n8n n8n From 2.46.0 (inc) to 2.46.1 (inc)
n8n n8n From 3.0.0 (inc) to 3.0.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-288 The product requires authentication, but the product has an alternate path or channel that does not require authentication.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

n8n before version 1.123.89 has an authentication bypass flaw in the Chat Trigger feature. This allows unauthenticated attackers to bypass n8n's user authentication by sending crafted GET requests to the chat webhook URL in embedded chat mode. Attackers can access named session conversation history or trigger workflows with malicious input.

Detection Guidance

Check for unauthenticated GET requests to the chat webhook URL in embedded chat mode. Monitor logs for suspicious access to named session conversation history or workflow triggers without proper authentication.

Impact Analysis

Unauthenticated attackers could read sensitive conversation data or execute unauthorized workflows. This may lead to data leaks, workflow manipulation, or further compromise of the n8n instance or connected systems.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection requirements and HIPAA's privacy rules. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Upgrade n8n to version 1.123.89 or later to patch the authentication bypass. Disable the Chat Trigger feature if not needed. Restrict access to the webhook URL and implement network-level authentication controls.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-126389. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...