CVE-2026-110846— n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook
Quick assessment
Affected
n8n-io n8n
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 n8n 2.41.4 之前以及 2.42.x 版本中早于 2.42.1 的版本中，等待式 Webhook（waiting-webhook）端点存在签名绕过漏洞。该漏洞发生在对替代节点引用格式进行归一化处理之前，提前选择了“发送并等待”（Send-and-Wait）验证机制。持有执行恢复令牌（resume token）的攻击者可以批准本应属于其他用户的等待式执行请求，从而以工作流所有者的身份运行下游操作，其中可能包括命令执行。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-110846
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook
Source: CVE Program / CVE List V5
Vulnerability Description
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不正确的行为次序：规范化之前验证
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-110846
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-110846
请登录查看更多情报信息。
Other References for CVE-2026-110846 (2)
Same Patch Batch · n8n-io · 2026-10-14 · 14 CVEs total
| CVE-2026-110843 | 8.2 HIGH | n8n before 2.41.4 and 2.42.1 Unauthenticated Unbounded OAuth Client Persistence via Author |
| CVE-2026-110842 | 7.7 HIGH | n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Workflow-Validation Interpreter |
| CVE-2026-110845 | 7.7 HIGH | n8n before 1.123.83, 2.41.4, and 2.42.1 Code Execution via Git Node Log Operation |
| CVE-2026-110850 | 7.2 HIGH | n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters |
| CVE-2026-110844 | 7.2 HIGH | n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows |
| CVE-2026-110849 | 7.2 HIGH | n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binary-Data File Preview |
| CVE-2026-110853 | 7.1 HIGH | n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON |
| CVE-2026-110847 | 7.0 HIGH | n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Chat Trigger customCss Parameter |
| CVE-2026-110840 | 7.0 HIGH | n8n before 2.41.4 and 2.42.1 SQL Injection via Microsoft SQL Node Query Field |
| CVE-2026-110852 | 6.3 MEDIUM | n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Workflow Execution via Dynamic-Pat |
| CVE-2026-110851 | 6.1 MEDIUM | n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endp |
| CVE-2026-110841 | 6.1 MEDIUM | n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval |
| CVE-2026-110848 | 6.0 MEDIUM | n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution via AI Workflow Builder Connec |
IV. Related Vulnerabilities
Same product: n8n
-
CVE-2026-110853
n8n before 1.123.83 Authorization Bypass via Execute Sub-wor -
CVE-2026-110852
n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Work -
CVE-2026-110851
n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership T -
CVE-2026-110850
n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Age -
CVE-2026-110849
n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binar
Same vendor: n8n-io
-
CVE-2026-110853
n8n before 1.123.83 Authorization Bypass via Execute Sub-wor -
CVE-2026-110852
n8n before 1.123.83, 2.41.4, and 2.42.1 Unauthenticated Work -
CVE-2026-110851
n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership T -
CVE-2026-110850
n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Age -
CVE-2026-110849
n8n before 1.123.83, 2.41.4, and 2.42.1 Stored XSS via Binar
Same weakness: CWE-180
-
CVE-2026-93326
Crafted Git build source can bypass certain policy validatio -
CVE-2026-105050
PeaZip <11.3.0 OS命令注入漏洞 -
CVE-2026-102269
PyJWT: Non-canonical signature segments enable raw-token rev -
CVE-2026-100674
stoatchat before 0.15.5 Username Validation Bypass via Unico -
CVE-2026-100547
OpenClaw before 2026.8.1 Authentication Bypass via File URL
V. Comments for CVE-2026-110846
No comments yet