CVE-2026-103260: n8n Approval Bypass Vulnerability

CVE-2026-103260 Overview

CVE-2026-103260 is a missing authorization vulnerability [CWE-862] in n8n, the open-source workflow automation platform. The flaw affects the Send and Wait node when configured in Approve Within Chat mode. Attackers can submit resume requests to waiting executions without any verification of the requester's identity or approval permissions. Unauthenticated users can advance paused workflows and trigger guarded actions that were intended to require human approval. The issue affects n8n versions before 2.39.6 and 2.40.0 before 2.40.1.

Critical Impact

Unauthenticated attackers can bypass human-in-the-loop approval checkpoints and trigger downstream workflow actions, undermining the integrity of automated business processes.

Affected Products

• n8n versions prior to 2.39.6
• n8n versions 2.40.0 before 2.40.1
• Workflows using the Send and Wait node in Approve Within Chat mode

Discovery Timeline

• 2026-10-01 - CVE-2026-103260 published to NVD
• 2026-10-01 - Last updated in NVD database

Technical Details for CVE-2026-103260

Vulnerability Analysis

n8n's Send and Wait node pauses workflow execution and waits for a human response before resuming. In Approve Within Chat mode, the node is intended to accept an approval decision from a designated approver and then continue downstream actions. The resume endpoint does not validate whether the caller is the intended approver or holds any approval permission on the workflow. Any party able to reach the resume URL can submit a response that satisfies the gate.

Because the Send and Wait node is commonly placed before sensitive automation steps such as payment release, access provisioning, or deployment, bypassing the approval converts a controlled human checkpoint into an unauthenticated trigger. The attacker does not need credentials, workflow access, or a valid session.

Root Cause

The root cause is missing authorization [CWE-862] on the resume handler used by the Send and Wait node. The handler accepts resume submissions based solely on knowledge of the execution reference, without binding the response to an authenticated identity or verifying membership in an approver set.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction from the legitimate approver. An attacker who learns or guesses the resume reference for a waiting execution can issue a crafted HTTP request to approve it. Resume references may leak through chat transcripts, logs, email metadata, or shared browser history, broadening exposure beyond direct network reach. The vulnerability is described in detail in the GitHub Security Advisory GHSA-342v-gmh6-738j and the VulnCheck Approval Bypass Advisory.

Detection Methods for CVE-2026-103260

Indicators of Compromise

• Workflow executions resumed from the Send and Wait node without a corresponding approver chat interaction in the chat platform's audit log.
• Resume HTTP requests originating from IP addresses or user agents that do not match the designated approver's typical client.
• Multiple resume attempts against the same execution ID within a short time window, suggesting enumeration.

Detection Strategies

• Correlate n8n execution logs with chat platform audit logs to confirm that each Approve Within Chat resume maps to a legitimate approver message.
• Alert on resume requests to Send and Wait endpoints that lack an authenticated session or that bypass the configured chat integration flow.
• Review historical executions involving the Send and Wait node for approvals that completed with no human interaction recorded.

Monitoring Recommendations

• Enable verbose logging on the n8n webhook and resume endpoints and ship logs to a centralized SIEM for correlation.
• Monitor for unusual spikes in approved workflows that invoke sensitive downstream nodes such as payment, provisioning, or deployment actions.
• Track the n8n service version in asset inventory and alert on hosts running affected releases.

How to Mitigate CVE-2026-103260

Immediate Actions Required

• Upgrade n8n to version 2.39.6, 2.40.1, or later as published in the vendor advisory.
• Audit all active workflows using the Send and Wait node in Approve Within Chat mode and review their recent execution history for unauthorized resumes.
• Rotate or invalidate any pending waiting executions created on vulnerable versions before upgrading.

Patch Information

The maintainers released fixes in n8n 2.39.6 and 2.40.1. Refer to the GitHub Security Advisory GHSA-342v-gmh6-738j for upgrade guidance and the specific commits addressing the authorization check in the Send and Wait resume handler.

Workarounds

• Temporarily replace Approve Within Chat mode with an approval mode that enforces authenticated interaction, such as a form-based approval behind an authenticated reverse proxy.
• Restrict network access to the n8n resume endpoints using an upstream proxy, VPN, or IP allowlist until patching is complete.
• Disable or redesign workflows that depend on Send and Wait approvals before executing high-impact actions until the upgrade is verified.

# Verify the installed n8n version and upgrade using npm
n8n --version
npm install -g n8n@2.40.1

# Or for Docker-based deployments
docker pull n8nio/n8n:2.40.1
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:2.40.1