Description

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.

Related CPE's

Could not find any relations

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-728h-pmr2-7cgh

https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-send-and-wait-hmac-signature-bypass-via-waiting-webhook

Weaknesses

[email protected]

Primary
CWE-180

CVSS impact metrics

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

7 · High

Information

Source identifier

[email protected]

Vulnerability status

Deferred

Published

2026-10-14T23:17:25.253Z

1 hour ago

Last modified

2026-10-14T23:17:25.363Z

1 hour ago