What’s Vulnerable › Vulnerabilities

CVE-2026-110846: n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

• Severity: high (CVSS 7.0 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-14 · updated 2026-10-20
• Weakness: CWE-180

Description

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.

Affected products

• n8n-io n8n: before 2.41.4; from 2.42.0 before 2.42.1 — fixed in 2.41.4, 2.42.1

How to fix

Upgrade to a fixed version: n8n-io n8n 2.41.4, 2.42.1. Check the vendor advisory for mitigations.

References

• https://github.com/n8n-io/n8n/security/advisories/GHSA-728h-pmr2-7cgh
• https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-send-and-wait-hmac-signature-bypass-via-waiting-webhook

Get alerted when CVE-2026-110846 or the next vulnerability affects your stack