CVE-2026-42228Disclosure(n8n / n8n)

LOWCVSS 6.5 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch n8n n8n systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /chat WebSocket endpoint used by the Chat Trigger node's Hosted Chat feature did not verify that an incoming connection was authorized to interact with the target execution. An unauthenticated remote attacker who could identify a valid execution ID for a workflow in a waiting state could attach to that execution, receive the pending prompt intended for the legitimate user, and submit arbitrary input to resume or influence downstream workflow behavior. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.

n8n CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/n8n-io/n8n/security/advisories/GHSA-f77h-j2v7-g6mw

Weakness type (CWE)

CWE-862

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

Threat summary

Patch or workaround signal is available
4 mentions across 3 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-05-04); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

n8n

Products

n8n

1 version affected across 1 product

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

Patch

125.0%

General

125.0%

Referenced assets5 URLs

By indicator

Classification over time

Date	Total	Labels

2026-05-04	2	Disclosure1Patch1
2026-05-05	1	General1
2026-06-15	1	Disclosure1

Full discourse4 posts

Ori@vbCrLf116d
Disclosure
Over the last few months, I researched Langflow, n8n, and Activepieces. The result is 9 zero-days and a BlueHat IL talk 🛠️ 🚨 CVE-2026-7524 (Critical - 9.8) 🚨 CVE-2026-48519 (Critical - 9.6) ⚠️ CVE-2026-7528 (High - 7.1) 🐛 CVE-2026-42228 (Moderate - 6.3) 🐛 CVE-2026-48520 (Moderate - 6.1) 🚨 CVE-not-yet-published (Critical - 9.0) 🚨 CVE-not-yet-published (Critical - 10.0) ⚠️ CVE-not-yet-published (High - 8.6) ⚠️ CVE-not-yet-published (High - 8.3) Thanks to the vendors for the cooperation and fixes. @Oranav and I will be breaking down some of these on stage at BlueHat IL 2026 Registration closes soon. Write-ups will be published after the con. Abstract: https://www.microsoftrnd.co.il/bluehatil/conference/abstracts#collapse-25 @BlueHatIL @msftsecresponse
Post summary
The post announces nine zero‑day vulnerabilities in Langflow, n8n, and Activepieces, including severity scores and a forthcoming BlueHat IL talk, without providing PoC or exploit details but noting vendor cooperation and forthcoming write‑ups.
11030468
43 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds158d
General
CVE-2026-42228 Unauthenticated WebSocket Access in n8n Chat Trigger Hosted Chat ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42228 Customizable Vulnerability Alerts: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=4
Post summary
The passage references CVE-2026-42228 with a brief description of unauthenticated WebSocket access, but provides no further technical details, proof of concept, exploitation evidence, or patch information.
0000040
4.0K followersView on X
Infoflowcloud@infoflowcloud158d
Patch
🚨*CVE* CVE-2026-42228 n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /chat WebSocket endpoint used by the Chat Trigger node's Hoste… https://www.cve.org/CVERecord?id=CVE-2026-42228 ----- Traducción: CVE-2026-42228 n8n… http://infoflow.cloud`
Post summary
The tweet notes CVE‑2026‑42228 affecting n8n’s /chat WebSocket endpoint and indicates that newer versions (post‑1.123.32, 2.17.4, 2.18.1) contain a patch, but provides no PoC, exploit, or active exploitation details.
0000033
75 followersView on X
CVE@CVEnew158d
Disclosure
CVE-2026-42228 n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /chat WebSocket endpoint used by the Chat Trigger node's Hoste… https://www.cve.org/CVERecord?id=CVE-2026-42228
Post summary
The CVE targets the /chat WebSocket endpoint in n8n versions prior to 1.123.32, 2.17.4, and 2.18.1, with newer releases implied to contain a fix. No PoC, exploit code, or evidence of active exploitation is provided.
00000159
57.4K followersView on X

CPE platform detail2 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

2 of 2 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	n8n	n8n	-	node.js	-
App	n8n	n8n	2.18.0	node.js	-

Explore more

Back to dashboard n8n CVEs n8n vulnerabilities

What researchers are saying

CVE-2026-42228

Ori[verified]@vbCrLfDisclosure

The post announces nine zero‑day vulnerabilities in Langflow, n8n, and Activepieces, including severity scores and a forthcoming BlueHat IL talk, without providing PoC or exploit details but noting vendor cooperation and forthcoming write‑ups.

Vulmon Vulnerability Feed@VulmonFeedsGeneral

The passage references CVE-2026-42228 with a brief description of unauthenticated WebSocket access, but provides no further technical details, proof of concept, exploitation evidence, or patch information.

Infoflowcloud@infoflowcloudPatch

The tweet notes CVE‑2026‑42228 affecting n8n’s /chat WebSocket endpoint and indicates that newer versions (post‑1.123.32, 2.17.4, 2.18.1) contain a patch, but provides no PoC, exploit, or active exploitation details.

CVE@CVEnewDisclosure

The CVE targets the /chat WebSocket endpoint in n8n versions prior to 1.123.32, 2.17.4, and 2.18.1, with newer releases implied to contain a fix. No PoC, exploit code, or evidence of active exploitation is provided.