CVE-2026-86077: n8n

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the chat route to release a Send-and-Wait, non-chat HITL, or Wait approval gate. The affected authorization logic is packages/cli/src/chat/chat-execution-manager.ts, where canResumeOverChat did not gate the resume target. This issue is fixed in versions 2.37.7 and 2.38.2.

Affected products

• n8n n8n: before 2.37.7 (fixed in 2.37.7); from 2.38.0, before 2.38.2 (fixed in 2.38.2)

Published 2026-09-08. Last modified 2026-09-14.