Incorrect authorization in n8n - CVE-2026-118640
Published: October 14, 2026 / Updated: November 2, 2026
Vulnerability identifier: #VU155718
CSH Severity: Low
CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118640
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to access and modify instance resources beyond the permissions of their role.
The vulnerability exists due to improper authorization in Chat Hub tool registration when registering tools for users with the chat user role. A remote user can register insufficiently restricted tool types and run them through a chat to access and modify instance resources beyond the permissions of their role.
Code execution through these tools occurs in the task runner sandbox, and file operations are limited to directories allowed by n8n.
Affected software
n8n
How to mitigate CVE-2026-118640
Install security update from vendor's website.
n8n - addressed in versions 1.123.85, 2.43.5, 2.44.1