CVE-2026-110846: n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook
n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs an execution's resume token. With that token, they can approve a waiting execution intended for another recipient by using the alternate node reference form.
Who is exposed to the greatest risk?
Workflows that use Send-and-Wait and have waiting executions are exposed if they run a vulnerable n8n version. Impact is greatest where downstream workflow actions run with the workflow owner's credentials, especially if those actions can execute commands.
Are default installations affected?
The issue affects n8n versions before 2.41.4 and 2.42.x versions before 2.42.1 when Send-and-Wait waiting-webhook functionality is used. The provided information does not establish whether this functionality is enabled or used by default.
What should be done if upgrading cannot happen immediately?
Limit access to execution resume tokens and treat existing tokens for waiting executions as sensitive. Review and restrict workflows whose downstream steps perform high-impact actions under owner credentials, including command execution.
How can I determine whether my deployment is affected?
Check whether n8n is running a version earlier than 2.41.4 or a 2.42.x version earlier than 2.42.1, and whether workflows use Send-and-Wait waiting executions. Also review whether resume tokens may be available to users other than the intended approver.