{"id":"GHSA-pwj5-wwm6-g83j","kind":"vulnerability","aliases":["GHSA-pwj5-wwm6-g83j"],"related":[],"title":"Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests","description":"## Impact\n\nThe Chat Trigger exempted its `setup` GET webhook route from the n8n User Auth check in all chat modes. The exemption was intended only for hosted chat, where the route serves the chat page, but it also applied to embedded chat. On a published Chat Trigger configured with embedded chat mode and n8n User Auth, an unauthenticated GET request to the chat webhook URL bypassed authentication and could read the conversation history of a named session, or trigger the workflow with attacker-supplied input.\n\n## Patches\n\nThe issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Deactivate Chat Trigger workflows configured in embedded chat mode with n8n User Auth until the instance is patched.\n- Apply network-level controls to restrict access to webhook endpoints.\n- Switch affected Chat Trigger workflows to basic auth if embedded chat mode must remain active.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"In n8n's Chat Trigger node, the setup GET webhook route skips the n8n User Auth check when the chat is embedded. An unauthenticated request can read the conversation history of a named session or run the workflow with attacker-supplied input.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 1.123.89"],"affected":"< 1.123.89","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.46.1"],"affected":"< 2.46.1","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.45.5"],"affected":"< 2.45.5","ecosystem":"npm"},{"name":"n8n","fixed":[">= 3.0.1"],"affected":"< 3.0.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","chat-trigger","embedded-chat","n8n","self-hosted"],"not_affected_if":["basic-auth","hosted-chat-only","no-chat-trigger"],"how_to_check":"- Check the n8n version with `n8n --version` or the package in `npm ls n8n`; versions below the fixed releases are exposed.\n- Find published Chat Trigger workflows set to embedded chat mode with n8n User Auth.","fix":"- n8n `1.123.89`\n- n8n `2.45.5`\n- n8n `2.46.1`\n- n8n `3.0.1`","status":"open","published_at":"2026-10-28T08:48:14+00:00","first_seen_at":"2026-11-09T22:53:26+00:00","triaged_at":"2026-11-09T22:55:04+00:00","updated_at":"2026-11-09T22:55:04+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:55:04Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `1.123.89`\n- n8n `2.45.5`\n- n8n `2.46.1`\n- n8n `3.0.1`","reach":"internet","title":"n8n: Chat Trigger embedded chat skips user auth on setup route","impact":"medium","summary":"In n8n's Chat Trigger node, the setup GET webhook route skips the n8n User Auth check when the chat is embedded. An unauthenticated request can read the conversation history of a named session or run the workflow with attacker-supplied input.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","chat-trigger","embedded-chat"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"unauthenticated attacker reads chat history or triggers workflows","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` or the package in `npm ls n8n`; versions below the fixed releases are exposed.\n- Find published Chat Trigger workflows set to embedded chat mode with n8n User Auth.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["hosted-chat-only","basic-auth","no-chat-trigger"],"who_is_affected":"Only published Chat Trigger workflows in embedded chat mode that use n8n User Auth are exposed; hosted chat and basic auth setups are not described as affected. Teams running self-hosted n8n with embedded chat widgets on their websites should check those workflows first. Teams that do not use the Chat Trigger node in embedded mode can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000804,"input_tokens":5045,"output_tokens":599,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'1.123.89':179C '2.45.5':180C '2.46.1':181C '3.0.1':183C 'access':215C,246C 'activ':264C 'administr':205C 'affect':251C 'ai':29B 'ai-tool':28B 'also':121C 'appli':122C,239C 'attack':81B,167C 'attacker-suppli':80B,166C 'auth':10A,56B,98C,139C,233C,257C 'authent':150C 'basic':256C 'bypass':149C 'chat':1A,4A,32B,36B,44B,60B,86C,102C,111C,117C,125C,129C,134C,146C,222C,228C,252C,260C 'chat-trigg':31B 'check':57B,99C 'configur':131C,225C 'consid':207C 'control':243C 'convers':69B,155C 'could':152C 'deactiv':221C 'embed':3A,35B,62B,124C,133C,227C,259C 'embedded-chat':34B 'endpoint':249C 'enforc':7A 'exempt':88C,105C 'fix':175C 'follow':209C 'fulli':217C,269C 'g83j':18A,23A 'get':49B,91C,142C 'ghsa':15A,20A 'ghsa-pwj5-wwm6-g83j':14A,19A 'histori':70B,156C 'host':40B,110C 'immedi':203C 'impact':84C 'input':83B,169C 'instanc':214C,236C 'intend':107C 'issu':172C 'later':193C 'level':242C 'measur':283C 'mitig':211C,282C 'mode':103C,135C,229C,261C 'must':262C 'n8n':8A,24A,25A,26A,27A,37B,42B,54B,96C,137C,177C,213C,231C 'name':73B,159C 'network':241C 'network-level':240C 'node':46B 'one':188C 'page':118C 'patch':170C,238C 'possibl':204C 'publish':128C 'pwj5':16A,21A 'read':67B,153C 'remain':263C 'remedi':195C,270C 'request':13A,65B,143C 'restrict':212C,245C 'risk':272C 'rout':51B,93C,114C 'run':76B 'self':39B 'self-host':38B 'serv':115C 'session':74B,160C 'setup':48B,90C 'short':280C 'short-term':279C 'skip':52B 'suppli':82B,168C 'switch':250C 'temporari':210C 'term':281C 'tool':30B 'trigger':2A,33B,45B,87C,130C,162C,223C,253C 'trust':218C 'unauthent':64B,141C 'upgrad':186C,200C 'url':148C 'use':277C 'user':9A,55B,97C,138C,184C,219C,232C 'version':178C,191C 'vulner':197C 'webhook':50B,92C,147C,248C 'workaround':198C,266C 'workflow':78B,164C,224C,254C 'wwm6':17A,22A","nicknames":[],"mitigations":[],"who_affected":"Only published Chat Trigger workflows in embedded chat mode that use n8n User Auth are exposed; hosted chat and basic auth setups are not described as affected. Teams running self-hosted n8n with embedded chat widgets on their websites should check those workflows first. Teams that do not use the Chat Trigger node in embedded mode can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["aitooling","chattrigger","embeddedchat","medium","n8n","npm","selfhosted"],"campaign_type":null,"search_a":"'auth':10A 'chat':1A,4A 'embed':3A 'enforc':7A 'g83j':18A,23A 'ghsa':15A,20A 'ghsa-pwj5-wwm6-g83j':14A,19A 'n8n':8A,24A,25A,26A,27A 'pwj5':16A,21A 'request':13A 'trigger':2A 'user':9A 'wwm6':17A,22A","search_b":"'ai':29B 'ai-tool':28B 'attack':81B 'attacker-suppli':80B 'auth':56B 'chat':32B,36B,44B,60B 'chat-trigg':31B 'check':57B 'convers':69B 'embed':35B,62B 'embedded-chat':34B 'get':49B 'histori':70B 'host':40B 'input':83B 'n8n':37B,42B,54B 'name':73B 'node':46B 'read':67B 'request':65B 'rout':51B 'run':76B 'self':39B 'self-host':38B 'session':74B 'setup':48B 'skip':52B 'suppli':82B 'tool':30B 'trigger':33B,45B 'unauthent':64B 'user':55B 'webhook':50B 'workflow':78B","search_c":"'1.123.89':179C '2.45.5':180C '2.46.1':181C '3.0.1':183C 'access':215C,246C 'activ':264C 'administr':205C 'affect':251C 'also':121C 'appli':122C,239C 'attack':167C 'attacker-suppli':166C 'auth':98C,139C,233C,257C 'authent':150C 'basic':256C 'bypass':149C 'chat':86C,102C,111C,117C,125C,129C,134C,146C,222C,228C,252C,260C 'check':99C 'configur':131C,225C 'consid':207C 'control':243C 'convers':155C 'could':152C 'deactiv':221C 'embed':124C,133C,227C,259C 'endpoint':249C 'exempt':88C,105C 'fix':175C 'follow':209C 'fulli':217C,269C 'get':91C,142C 'histori':156C 'host':110C 'immedi':203C 'impact':84C 'input':169C 'instanc':214C,236C 'intend':107C 'issu':172C 'later':193C 'level':242C 'measur':283C 'mitig':211C,282C 'mode':103C,135C,229C,261C 'must':262C 'n8n':96C,137C,177C,213C,231C 'name':159C 'network':241C 'network-level':240C 'one':188C 'page':118C 'patch':170C,238C 'possibl':204C 'publish':128C 'read':153C 'remain':263C 'remedi':195C,270C 'request':143C 'restrict':212C,245C 'risk':272C 'rout':93C,114C 'serv':115C 'session':160C 'setup':90C 'short':280C 'short-term':279C 'suppli':168C 'switch':250C 'temporari':210C 'term':281C 'trigger':87C,130C,162C,223C,253C 'trust':218C 'unauthent':141C 'upgrad':186C,200C 'url':148C 'use':277C 'user':97C,138C,184C,219C,232C 'version':178C,191C 'vulner':197C 'webhook':92C,147C,248C 'workaround':198C,266C 'workflow':164C,224C,254C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-28T08:48:14+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-pwj5-wwm6-g83j","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pwj5-wwm6-g83j","severity":"medium","published_at":"2026-10-28T08:48:14+00:00","modified_at":"2026-10-28T08:48:14+00:00","first_seen_at":"2026-11-09T22:53:26+00:00","fetched_at":"2026-11-09T22:53:26+00:00","note":null}],"documents":[{"id":110633,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pwj5-wwm6-g83j","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}