{"id":"CVE-2026-118640","kind":"vulnerability","aliases":["CVE-2026-118640"],"related":[],"title":"n8n: chat-only users can register restricted tools and run workflows","description":"n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool types. Users with the global:chatUser role can add and run tools through chat to execute sandboxed code, access permitted files, and use instance workflows, Data Tables, and agents.","summary":"n8n Chat Hub lets users with the global:chatUser role register restricted tool types they should not have access to. An attacker with a chat-only account can run sandboxed code, reach permitted files, and use instance workflows, Data Tables, and agents.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","n8n","self-hosted","workflows"],"not_affected_if":["no-chat-users","patched-version"],"how_to_check":"- Run `n8n --version` (or check the image tag) and compare against `1.123.85`, `2.43.5` and `2.44.1`\n- List users holding the `global:chatUser` role in the n8n admin settings and confirm whether chat-only accounts exist","fix":"- Upgrade n8n to `1.123.85` on the 1.x line, `2.43.5` on the 2.43 line, or `2.44.1` on the 2.44 line\n- Until patched, remove the `global:chatUser` role from untrusted accounts","status":"open","published_at":"2026-10-28T19:17:31+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","triaged_at":"2026-10-28T19:36:13+00:00","updated_at":"2026-10-28T19:36:13+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-28T19:36:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade n8n to `1.123.85` on the 1.x line, `2.43.5` on the 2.43 line, or `2.44.1` on the 2.44 line\n- Until patched, remove the `global:chatUser` role from untrusted accounts","reach":"network","title":"n8n: chat-only users can register restricted tools and run workflows","impact":"high","summary":"n8n Chat Hub lets users with the global:chatUser role register restricted tool types they should not have access to. An attacker with a chat-only account can run sandboxed code, reach permitted files, and use instance workflows, Data Tables, and agents.","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","ai-agents","workflows"],"confidence":0.6,"needs_auth":"yes","worst_case":"Chat-only user runs sandboxed code and reads instance workflows and data","analyst_note":"Check the n8n GitHub security advisory for the exact restricted tool list and whether Chat Hub must be enabled by default; the NVD entry does not say.","how_to_check":"- Run `n8n --version` (or check the image tag) and compare against `1.123.85`, `2.43.5` and `2.44.1`\n- List users holding the `global:chatUser` role in the n8n admin settings and confirm whether chat-only accounts exist","needs_analyst":true,"not_affected_if":["patched-version","no-chat-users"],"who_is_affected":"Self-hosted n8n instances that have Chat Hub in use and accounts with the global:chatUser role, since those accounts are the ones that can register restricted tools. Instances with no chat-only users have little exposure, but the sources do not say how common Chat Hub use is. Teams on the patched versions can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000655,"input_tokens":3349,"output_tokens":641,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118640':15A,18A '-2026':14A,17A '1.123.85':75C '2.43.5':76C '2.44.1':78C 'access':48B,115C 'account':57B 'add':105C 'agent':21B,72B,125C 'ai':20B,23B 'ai-ag':19B 'ai-tool':22B 'allow':88C 'attack':51B 'author':81C 'bypass':82C 'chat':3A,31B,55B,85C,90C,110C 'chat-on':2A,54B,89C 'chatus':38B,102C 'code':61B,114C 'contain':79C 'cve':13A,16A 'data':69B,122C 'execut':112C 'file':64B,117C 'global':37B,101C 'host':28B 'hub':32B,86C 'instanc':67B,120C 'let':33B 'n8n':1A,25B,30B,73C 'permit':63B,116C 'reach':62B 'regist':7A,40B,94C 'restrict':8A,41B,95C 'role':39B,103C 'run':11A,59B,107C 'sandbox':60B,113C 'self':27B 'self-host':26B 'tabl':70B,123C 'tool':9A,24B,42B,96C,108C 'type':43B,97C 'use':66B,119C 'user':5A,34B,92C,98C 'vulner':83C 'workflow':12A,29B,68B,121C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted n8n instances that have Chat Hub in use and accounts with the global:chatUser role, since those accounts are the ones that can register restricted tools. Instances with no chat-only users have little exposure, but the sources do not say how common Chat Hub use is. Teams on the patched versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118640","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118640","severity":null,"published_at":"2026-10-28T19:17:31+00:00","modified_at":"2026-10-28T19:17:31+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","fetched_at":"2026-10-28T19:34:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}