Live › vulnerability › CVE-2026-118677
Go to dashboardn8n's Local Gateway desktop app accepts an n8n-computer-use:// deep link that re-pairs it with a different n8n instance without confirmation. An attacker who lures a user into opening a crafted link can act on the user's computer through the gateway with the permissions already granted.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Users who run the n8n Local Gateway desktop app on a machine they use to act through n8n, on n8n versions before 2.41.4 and 2.42.x before 2.42.1. The exposure comes from the desktop app's deep-link handler, so self-hosted and cloud n8n servers without the Local Gateway are not the target. Teams that do not run the Local Gateway can skip it.
No product ranges from the sources yet.
2.41.4 or later on the 2.41 line, or to 2.42.1 or later on the 2.42 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently re-pair the app with a different n8n instance. Attackers can lure users running the Local Gateway into opening a crafted n8n-computer-use:// link to connect their computer to an attacker-controlled instance, inheriting previously granted permissions and acting on the computer through the gateway.
This page as .md · .json · in your agent: get_signal("CVE-2026-118677")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.