Missing Authentication for Critical Function in n8n - CVE-2026-126389
Published: November 9, 2026 / Updated: November 13, 2026
Vulnerability identifier: #VU163080
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-126389
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to read conversation history or trigger workflows without authenticating to n8n.
The vulnerability exists due to an authentication exemption for the Chat Trigger's setup GET route that also applies to published workflows configured with embedded chat and n8n User Auth. An unauthenticated remote attacker can send a GET request to the chat webhook URL to retrieve a named session's history or submit workflow input.
Affected software
n8n
How to mitigate CVE-2026-126389
Install security update from vendor's website.
n8n - addressed in versions 1.123.89, 2.45.5, 2.46.1, 3.0.1