{"id":"CVE-2026-126389","kind":"vulnerability","aliases":["CVE-2026-126389"],"related":[],"title":"n8n: Chat Trigger auth bypass exposes session history and workflow triggers","description":"n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated attackers to skip n8n User Auth through the setup GET webhook route in embedded chat mode. Attackers can send unauthenticated GET requests to the chat webhook URL to read named session conversation history or trigger workflows with attacker-supplied input.","summary":"n8n before 1.123.89 has an authentication bypass in the Chat Trigger node: the setup GET webhook route in embedded chat mode skips n8n User Auth. An unauthenticated attacker can read named chat session conversation history or trigger workflows with attacker-supplied input.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","chat-trigger","n8n","self-hosted","workflow-automation"],"not_affected_if":["already-patched","managed-hosting","no-chat-trigger"],"how_to_check":"- Check the n8n version with `n8n --version` or the instance's About page; versions below `1.123.89` are in range.\n- Look for workflows that use the Chat Trigger node in embedded chat mode.","fix":"- n8n: upgrade to `1.123.89` or later.","status":"open","published_at":"2026-11-13T10:17:42+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","triaged_at":"2026-11-13T10:55:21+00:00","updated_at":"2026-11-13T10:55:21+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-11-13T10:55:21Z","model":"claude-haiku-5-5","output":{"fix":"- n8n: upgrade to `1.123.89` or later.","reach":"internet","title":"n8n: Chat Trigger auth bypass exposes session history and workflow triggers","impact":"medium","summary":"n8n before 1.123.89 has an authentication bypass in the Chat Trigger node: the setup GET webhook route in embedded chat mode skips n8n User Auth. An unauthenticated attacker can read named chat session conversation history or trigger workflows with attacker-supplied input.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","chat-trigger","workflow-automation"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker reads chat history and triggers workflows without logging in","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` or the instance's About page; versions below `1.123.89` are in range.\n- Look for workflows that use the Chat Trigger node in embedded chat mode.\n- unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["already-patched","no-chat-trigger","managed-hosting"],"who_is_affected":"Self-hosted n8n instances before 1.123.89 that run a workflow with a Chat Trigger node in embedded chat mode are exposed, since the bypass is on the chat webhook's setup GET route. Instances with no Chat Trigger workflows, or that are already on 1.123.89 or later, are not affected by this issue.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000757,"input_tokens":4626,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-126389':14A,17A '-2026':13A,16A '1.123.89':33B,76C 'ai':19B 'ai-tool':18B 'allow':87C 'attack':58B,71B,89C,105C,127C 'attacker-suppli':70B,126C 'auth':4A,55B,94C 'authent':36B,79C 'autom':30B 'bypass':5A,37B,80C 'chat':2A,22B,40B,50B,62B,84C,103C,113C 'chat-trigg':21B 'contain':77C 'convers':64B,120C 'cve':12A,15A 'embed':49B,102C 'expos':6A 'get':45B,98C,109C 'histori':8A,65B,121C 'host':27B 'input':73B,129C 'mode':51B,104C 'n8n':1A,24B,31B,53B,74C,92C 'name':61B,118C 'node':42B 'read':60B,117C 'request':110C 'rout':47B,100C 'self':26B 'self-host':25B 'send':107C 'session':7A,63B,119C 'setup':44B,97C 'skip':52B,91C 'suppli':72B,128C 'tool':20B 'trigger':3A,11A,23B,41B,67B,85C,123C 'unauthent':57B,88C,108C 'url':115C 'user':54B,93C 'vulner':81C 'webhook':46B,99C,114C 'workflow':10A,29B,68B,124C 'workflow-autom':28B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted n8n instances before 1.123.89 that run a workflow with a Chat Trigger node in embedded chat mode are exposed, since the bypass is on the chat webhook's setup GET route. Instances with no Chat Trigger workflows, or that are already on 1.123.89 or later, are not affected by this issue.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["aitooling","chattrigger","medium","n8n","selfhosted","workflowautomation"],"campaign_type":null,"search_a":"'-126389':14A,17A '-2026':13A,16A 'auth':4A 'bypass':5A 'chat':2A 'cve':12A,15A 'expos':6A 'histori':8A 'n8n':1A 'session':7A 'trigger':3A,11A 'workflow':10A","search_b":"'1.123.89':33B 'ai':19B 'ai-tool':18B 'attack':58B,71B 'attacker-suppli':70B 'auth':55B 'authent':36B 'autom':30B 'bypass':37B 'chat':22B,40B,50B,62B 'chat-trigg':21B 'convers':64B 'embed':49B 'get':45B 'histori':65B 'host':27B 'input':73B 'mode':51B 'n8n':24B,31B,53B 'name':61B 'node':42B 'read':60B 'rout':47B 'self':26B 'self-host':25B 'session':63B 'setup':44B 'skip':52B 'suppli':72B 'tool':20B 'trigger':23B,41B,67B 'unauthent':57B 'user':54B 'webhook':46B 'workflow':29B,68B 'workflow-autom':28B","search_c":"'1.123.89':76C 'allow':87C 'attack':89C,105C,127C 'attacker-suppli':126C 'auth':94C 'authent':79C 'bypass':80C 'chat':84C,103C,113C 'contain':77C 'convers':120C 'embed':102C 'get':98C,109C 'histori':121C 'input':129C 'mode':104C 'n8n':74C,92C 'name':118C 'read':117C 'request':110C 'rout':100C 'send':107C 'session':119C 'setup':97C 'skip':91C 'suppli':128C 'trigger':85C,123C 'unauthent':88C,108C 'url':115C 'user':93C 'vulner':81C 'webhook':99C,114C 'workflow':124C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-126389","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-126389","severity":null,"published_at":"2026-11-13T10:17:42+00:00","modified_at":"2026-11-13T10:17:42+00:00","first_seen_at":"2026-11-13T10:47:18+00:00","fetched_at":"2026-11-13T10:47:18+00:00","note":null}],"documents":[{"id":110633,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pwj5-wwm6-g83j","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-10-28T08:48:14+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145021,"url":"https://www.vulncheck.com/advisories/n8n-before-1.123.89-authentication-bypass-via-chat-trigger-embedded-chat","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}