CVE-2026-126389
n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat
n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated attackers to skip n8n User Auth through the setup GET webhook route in embedded chat mode. Attackers can send unauthenticated GET requests to the chat webhook URL to read named session conversation history or trigger workflows with attacker-supplied input.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
What each source reports
CVE List Score used
n8n before 1.123.89 Authentication Bypass via Chat Trigger Embedded Chat
n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated attackers to skip n8n User Auth through the setup GET webhook route in embedded chat mode. Attackers can send unauthenticated GET requests to the chat webhook URL to read named session conversation history or trigger workflows with attacker-supplied input.
- Record
CVE-2026-126389- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N - Weakness
- CWE-288
- Updated
- 2026-11-13
EUVDEUVD-2026-125176
n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated attackers to skip n8n User Auth through the setup GET webhook route in embedded chat mode. Attackers can send unauthenticated GET requests to the chat webhook URL to read named session conversation history or trigger workflows with attacker-supplied input.
- Record
EUVD-2026-125176- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:L/SA:N - Updated
- 2026-11-13
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-126389 is a medium vulnerability (CVSS 6.3) in N8n-io N8n, published November 13, 2026. No source lists public exploit code. No source names a fixed version.