{"id":"CVE-2026-118677","kind":"vulnerability","aliases":["CVE-2026-118677"],"related":[],"title":"n8n Local Gateway: deep link silently re-pairs to attacker instance","description":"n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently re-pair the app with a different n8n instance. Attackers can lure users running the Local Gateway into opening a crafted n8n-computer-use:// link to connect their computer to an attacker-controlled instance, inheriting previously granted permissions and acting on the computer through the gateway.","summary":"n8n's Local Gateway desktop app accepts an n8n-computer-use:// deep link that re-pairs it with a different n8n instance without confirmation. An attacker who lures a user into opening a crafted link can act on the user's computer through the gateway with the permissions already granted.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","desktop","local-gateway","n8n"],"not_affected_if":["fixed-version","no-local-gateway"],"how_to_check":"- Check the installed Local Gateway version against the fixed releases listed in the advisory, and look for n8n Local Gateway in the desktop app list.\n- Confirm which n8n instance the Local Gateway is paired with in its settings.","fix":"- Upgrade n8n to `2.41.4` or later on the 2.41 line, or to `2.42.1` or later on the 2.42 line.\n- Revoke and re-pair the Local Gateway after upgrading if an unknown instance was paired.","status":"open","published_at":"2026-10-28T19:17:33+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","triaged_at":"2026-10-28T19:36:13+00:00","updated_at":"2026-10-28T19:36:13+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-28T19:36:13Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade n8n to `2.41.4` or later on the 2.41 line, or to `2.42.1` or later on the 2.42 line.\n- Revoke and re-pair the Local Gateway after upgrading if an unknown instance was paired.","reach":"internet","title":"n8n Local Gateway: deep link silently re-pairs to attacker instance","impact":"high","summary":"n8n's Local Gateway desktop app accepts an n8n-computer-use:// deep link that re-pairs it with a different n8n instance without confirmation. An attacker who lures a user into opening a crafted link can act on the user's computer through the gateway with the permissions already granted.","category":"ai-tooling","nicknames":[],"who_cares":["n8n","local-gateway","desktop","ai-agents"],"confidence":0.7,"needs_auth":"no","worst_case":"attacker-controlled instance acts on the user's computer via gateway","analyst_note":"Confirm the exact fixed versions and whether the advisory lists a GHSA or vendor post with the Local Gateway upgrade path; the NVD entry gives only the version ranges.","how_to_check":"- Check the installed Local Gateway version against the fixed releases listed in the advisory, and look for n8n Local Gateway in the desktop app list.\n- Confirm which n8n instance the Local Gateway is paired with in its settings.","needs_analyst":true,"not_affected_if":["no-local-gateway","fixed-version"],"who_is_affected":"Users who run the n8n Local Gateway desktop app on a machine they use to act through n8n, on n8n versions before 2.41.4 and 2.42.x before 2.42.1. The exposure comes from the desktop app's deep-link handler, so self-hosted and cloud n8n servers without the Local Gateway are not the target. Teams that do not run the Local Gateway can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000679,"input_tokens":3387,"output_tokens":681,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118677':15A,18A '-2026':14A,17A '2.41.4':84C '2.42':86C '2.42.1':89C 'accept':36B 'act':68B,153C 'agent':21B 'ai':20B,23B 'ai-ag':19B 'ai-tool':22B 'allow':102C 'alreadi':80B 'app':35B,100C,115C 'attack':11A,57B,121C,145C 'attacker-control':144C 'comput':40B,73B,135C,141C,156C 'confirm':55B,93C 'connect':107C,139C 'contain':90C 'control':146C 'craft':65B,132C 'cve':13A,16A 'deep':4A,42B,105C 'deep-link':104C 'desktop':25B,34B,99C 'differ':51B,118C 'gateway':3A,28B,33B,76B,98C,128C,159C 'grant':81B,150C 'handler':108C 'inherit':148C 'instanc':12A,53B,120C,147C 'link':5A,43B,66B,106C,137C 'local':2A,27B,32B,97C,127C 'local-gateway':26B 'lure':59B,123C 'miss':92C 'n8n':1A,29B,30B,39B,52B,82C,119C,134C 'n8n-computer-use':38B,133C 'open':63B,130C 'pair':9A,47B,113C 'permiss':79B,151C 'previous':149C 're':8A,46B,112C 're-pair':7A,45B,111C 'run':125C 'silent':6A,110C 'tool':24B 'use':41B,136C 'user':61B,71B,124C 'vulner':94C 'without':54B 'x':87C","nicknames":[],"mitigations":[],"who_affected":"Users who run the n8n Local Gateway desktop app on a machine they use to act through n8n, on n8n versions before 2.41.4 and 2.42.x before 2.42.1. The exposure comes from the desktop app's deep-link handler, so self-hosted and cloud n8n servers without the Local Gateway are not the target. Teams that do not run the Local Gateway can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118677","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118677","severity":null,"published_at":"2026-10-28T19:17:33+00:00","modified_at":"2026-10-28T19:17:33+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","fetched_at":"2026-10-28T19:34:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}