The Check Ran Against the Wrong Thing: n8n’s Fourteen-CVE October Batch

2026-10-15 AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 14 October 2026 at 23:17 UTC, fourteen CVE records — CVE-2026-110840 through CVE-2026-110853 — were published against n8n, the workflow-automation platform (207,415 stars, 61,124 forks) that has become default plumbing for agentic systems. Every record names the same fix lines: 2.41.4, 2.42.1, and for eight of the fourteen, 1.123.83. All three shipped on 30 September 2026. The advisories behind them are n8n’s own GitHub Security Advisories; the CVE Numbering Authority on all fourteen records is VulnCheck, and every NVD record carries status Deferred with scores ranging from 6.0 to 8.2.

The headline finding is not any single CVE. It is that the batch reads as a systematic audit of every trust boundary an agent platform owns — and in nearly every case, a check did run. It just ran against a different thing than the thing that executed. The credential check inspected the credentials field while the secrets rode in agent-node parameters. The project-permission check ran against the project the caller named while the Agent being rewritten belonged to another. The webhook matcher verified the path while the identity lived in the part of the URL it ignored. The signature validator picked its scheme before normalising the reference that selects a different one. Fourteen times, the gate and the execution disagreed about what they were looking at.

The agent-surface CVEs first

Five of the fourteen sit directly on agent functionality, and they are the reason this batch belongs in an agent-security briefing rather than a generic roundup.

CVE-2026-110841 (6.1, CWE-639) is an authorisation bypass in the agent chat resume endpoint. The endpoint accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller, so an authenticated project member can list and read other members’ private agent conversations through project-scoped endpoints — and then approve their pending tool calls, causing the tools to execute and write results into the victim’s conversation. Read that twice: the human-in-the-loop approval gate, the control the whole industry points at when asked how agents stay supervised, becomes a control the wrong human can operate. Your pending tool call can be approved by someone who was never meant to see the conversation, and the tools then run under your authority.

CVE-2026-110842 (7.7, CWE-1321) is prototype pollution in the MCP workflow-validation tool, and its CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H) is doing quiet work: total compromise of confidentiality, integrity and availability from a low-privileged authenticated member with no user interaction. The mechanism is the one to study. The tool’s interpreter evaluates caller-supplied code in the main process, reads inherited properties, and permits assignment onto shared prototypes. A member holding only a workflow:read grant can replace a built-in method with one returning a truthy value, so server-side permission checks accept scopes the caller does not hold — enabling takeover of owner accounts not protected by MFA. The validator that was supposed to check workflows became the thing that rewrote the meaning of “check.” Readers of our July account of n8n’s sixteen-advisory batch reaching the expression sandbox, credentials and MCP will recognise the shape: the evaluation surface keeps being where the privilege boundary is thinnest.

CVE-2026-110845 (7.7, CWE-15) is code execution in the Git node’s Log operation, which fails to strip a repository’s local git configuration before invoking an external program. Any authenticated member who can point the node — including as an agent tool — at a repository whose local configuration they control gets program execution as the n8n process user. That italicised clause is the whole story for agent deployments: nodes are tools now, and a tool the model can aim at adversary-controlled configuration is remote code execution with the model as the delivery driver. There is a companion worth naming here even though it is a separate project’s record: six GitPython CVEs published the same evening turn on exactly this class of defect — repository-controlled strings reaching git’s argument vector — and we cover them separately.

CVE-2026-110850 (7.2, CWE-863) is the credential check that looked at the wrong field. When an editor saves a shared workflow, the credential-id validation inspects only the node’s credentials field — so an editor configures a Message-an-Agent node in inline mode with tools they control, the owner’s credentials resolve at execution, and decrypted secrets go to an attacker-chosen destination. CVE-2026-110844 (7.2, CWE-863) is the same theme one layer down: shared-workflow editors embed restricted credentials in nested or tool-inline sub-workflows (Workflow Tool, Workflow Retriever), which execute with the owner’s credential values. And CVE-2026-110851 (6.1, CWE-639) accepts a caller-supplied Agent ID in the Agents create endpoint, checks permissions only against the requested project, and updates an existing Agent without verifying which project owns it — so read-only access to another project’s Agents is enough to move one into your own project and rewrite its name, schema and version.

The unauthenticated one matters most

CVE-2026-110852 (6.3, CWE-288) will be under-scored by every triage queue that sorts by number, and it is the record to patch first. Dynamic-path webhook resolution matched requests on the path alone, ignoring the server-generated identifier that is the URL’s only unguessable component. Unauthenticated attackers omit the identifier in requests to webhook, form, or MCP routes and execute workflows in unrelated projects under those projects’ credentials. No account, no token, no guessing: the identifier was the authentication, and the router did not ask for it. In an n8n deployment wired to agents — MCP routes are explicitly in scope — this is unauthenticated invocation of other tenants’ workflows with their credentials attached.

The remaining records fill out the batch. CVE-2026-110840 (7.0, CWE-89): SQL injection in version 1 of the Microsoft SQL node, substituting Query-field expression values directly into SQL text, so webhook-bound input reaches the connected database with the stored credential’s privileges. CVE-2026-110843 (8.2, CWE-770), the highest-scored of the fourteen: uncontrolled resource consumption in the unauthenticated OAuth authorise endpoint, where identifiers differing only in query string create unlimited first-party client records past the registration cap until the disk fills. CVE-2026-110846 (7.0, CWE-180): a Send-and-Wait HMAC signature bypass that selects validation before normalising an alternate node-reference form, letting a resume-token holder approve waiting executions meant for others — downstream actions then run under the workflow owner’s credentials, potentially including command execution. CVE-2026-110853 (7.1, CWE-639): workflow-identity spoofing via a trusted identifier in Execute Sub-workflow inline JSON mode, resolving other projects’ credentials and touching their static data and error-workflow dispatch. Two stored-XSS records close the set: CVE-2026-110847 (7.0, CWE-79) via Chat Trigger customCss interpolated as markup on the instance origin, and CVE-2026-110849 (7.2, CWE-79) via the file-preview modal re-publishing binary data as unsandboxed same-origin blob URLs — a member uploads, the owner previews, the script runs as the owner. Plus CVE-2026-110848 (6.0, CWE-1321): nodes named __proto__ created through the API pollute the global object prototype via the connect-nodes operation in the AI workflow builder, disrupting the instance until restart — the builder that assembles agent workflows treats a node name as an object member without checking for reserved keys.

The timeline is the story, again

Line up the dates from the release metadata, all read first-hand from the GitHub API:

30 September 2026, 05:56 UTC — n8n@2.42.1 ships.
30 September 2026, 06:04 UTC — n8n@2.41.4 ships.
30 September 2026, 06:13 UTC — n8n@1.123.83 ships.
14 October 2026, 23:17 UTC — all fourteen CVE records go public, fourteen days later.

Fourteen days of fixed-but-unlabelled releases, during which scanners had fourteen CVE-shaped holes and nothing to match. We have now documented this exact pattern — the quiet fix, the fortnight-plus of silence, the evening batch of records — for Komodo’s Periphery agent, patched in July and disclosed in October, for NVIDIA’s AI-stack bulletins, for PraisonAI’s June fixes, and for GitPython’s 3.2.0 security release published the same evening as this batch. At this point it is not a coincidence of coordination; it is the industry’s steady state, and defensive planning should assume a standing two-week window in which the fix exists, the advisory does not, and the diff is public.

What to do

Upgrade to 2.41.4+, 2.42.1+, or 1.123.83+ depending on which release line you track — and note the fragmentation: the three lines each have their own fixed version, and several CVEs affect only some lines (110844 and 110853 are 1.x-line records; 110841’s statement names 2.42.0, not the whole 2.42.x range). Know your line before you declare yourself patched. Current releases as of this writing are well past all three (2.44.x, 1.123.85), so anything reasonably fresh is covered — the exposure is concentrated in pinned self-hosted deployments, which is to say most of them.

Two prioritisation notes beyond “patch everything.” First, treat 110852 as the perimeter issue: unauthenticated, MCP routes in scope, other projects’ credentials doing the work. If your n8n is reachable and hosts webhooks for more than one trust domain, that record is your incident-response scoping exercise until you confirm the upgrade. Second, treat 110850 and 110844 as credential-rotation triggers, not just patch items: both describe paths by which shared-workflow editors could already have resolved owner credentials to attacker-chosen destinations. The patch stops the next exfiltration; it does not un-send the last one.

And the generalisable rule, the one this batch demonstrates fourteen times: when a check and an execution both touch a request, verify they are looking at the same field, same normalisation, same ownership. The n8n codebase had permission checks, credential validation, signature verification, identifier matching and scope enforcement. Every one of them ran. Every bypass in this batch walks through the gap between what was checked and what was used.

Reporting note: all fourteen CVE IDs, publication timestamps, CVSS scores, CWE identifiers, descriptions, affected-version statements and advisory references were read first-hand from the NVD 2.0 API (CNA: VulnCheck; all records status Deferred at time of writing). Release tags and publication timestamps were read first-hand from the GitHub releases API; repository metadata (207,415 stars, 61,124 forks) from the GitHub repository API. The linked GitHub Security Advisory pages are client-rendered and were not directly readable; advisory content is reported via the CNA-authored NVD record text. Nothing was installed, no n8n instance was deployed, no workflow was created or executed, no credential was used, and no payload was sent. Brave Search returned only CVE-mirror aggregators and one removed community post; no independent technical analysis was available at the time of writing.

Sources: