---
id: "GHSA-pwj5-wwm6-g83j"
page: "https://infrastack.ai/live/GHSA-pwj5-wwm6-g83j"
kind: "vulnerability"
aliases: ["GHSA-pwj5-wwm6-g83j"]
title: "Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "n8n", "fixed": [">= 1.123.89"], "affected": "< 1.123.89", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.46.1"], "affected": "< 2.46.1", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.45.5"], "affected": "< 2.45.5", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 3.0.1"], "affected": "< 3.0.1", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "chat-trigger", "embedded-chat", "n8n", "self-hosted"]
not_affected_if: ["basic-auth", "hosted-chat-only", "no-chat-trigger"]
published_at: "2026-10-28T08:48:14+00:00"
first_seen_at: "2026-11-09T22:53:26+00:00"
updated_at: "2026-11-09T22:55:04+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-pwj5-wwm6-g83j", "first_seen_at": "2026-11-09T22:53:26+00:00"}]
exploit_sources: []
---

# Chat Trigger Embedded Chat Does Not Enforce n8n User Auth on All Requests

Link for people: https://infrastack.ai/live/GHSA-pwj5-wwm6-g83j (this .md is for agents)

In n8n's Chat Trigger node, the setup GET webhook route skips the n8n User Auth check when the chat is embedded. An unauthenticated request can read the conversation history of a named session or run the workflow with attacker-supplied input.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:n8n affected < 1.123.89 fixed >= 1.123.89
- npm:n8n affected < 2.46.1 fixed >= 2.46.1
- npm:n8n affected < 2.45.5 fixed >= 2.45.5
- npm:n8n affected < 3.0.1 fixed >= 3.0.1

## How to check

- Check the n8n version with `n8n --version` or the package in `npm ls n8n`; versions below the fixed releases are exposed.
- Find published Chat Trigger workflows set to embedded chat mode with n8n User Auth.

## Fix

- n8n `1.123.89`
- n8n `2.45.5`
- n8n `2.46.1`
- n8n `3.0.1`

## Timeline

- 2026-11-09T22:53:26+00:00 ghsa-repo https://github.com/n8n-io/n8n/security/advisories/GHSA-pwj5-wwm6-g83j

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-pwj5-wwm6-g83j

## From the sources

## Impact

The Chat Trigger exempted its `setup` GET webhook route from the n8n User Auth check in all chat modes. The exemption was intended only for hosted chat, where the route serves the chat page, but it also applied to embedded chat. On a published Chat Trigger configured with embedded chat mode and n8n User Auth, an unauthenticated GET request to the chat webhook URL bypassed authentication and could read the conversation history of a named session, or trigger the workflow with attacker-supplied input.

## Patches

The issue has been fixed in n8n versions 1.123.89, 2.45.5, 2.46.1 and 3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Deactivate Chat Trigger workflows configured in embedded chat mode with n8n User Auth until the instance is patched.
- Apply network-level controls to restrict access to webhook endpoints.
- Switch affected Chat Trigger workflows to basic auth if embedded chat mode must remain active.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_