N8N · GHSA-cwm2-vhf5-27q9 · AI agents & MCP
FIX → >= 2.42.1 +1
The n8n Local Gateway desktop app can be made to connect to another n8n instance without user confirmation, and previously granted permissions carry over to that instance. An attacker who gets a user to open a crafted link can act on the user's computer through the gateway.
first public Oct 14, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run the n8n Local Gateway desktop app with Computer Use enabled are exposed, and the victim must have the app installed and running and open a crafted link. Self-hosted n8n servers without the Local Gateway feature in use are not affected by this flaw.
Not affected if app-not-installed, feature-disabled, version-patched
Who cares computer-use, desktop, local-gateway, n8n
n8n --version on servers, and the version shown for the n8n package in your project lockfile.allowedOrigins setting is left at its default wildcard.Upgrade to >= 2.42.1 +1
The Local Gateway desktop app could be made to connect to another n8n instance without the user's confirmation, and permissions the user had already granted carried over to that instance. An attacker who gets a user to open a crafted link could connect the user's computer to an instance the attacker controls and act on it through the gateway.
The victim must have the Local Gateway app installed and running and must open a crafted link.
The issue has been fixed in n8n versions 2.42.1 and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
n8n-computer-use:// scheme.allowedOrigins setting to the specific instance URL the Gateway is paired with, rather than relying on the default wildcard.These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
2.42.1 or later on the 2.42 line, or 2.41.4 or later on the 2.41 line.