GHSA-43v8-hjhm-chjp: n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass
Published Oct 28, 2026
·Updated
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows chat-only users to register restricted tool types. Users with the global:chatUser role can add and run tools through chat to execute sandboxed code, access permitted files, and use instance workflows, Data Tables, and agents.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.85 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.43.5 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.44.1
Event History
Oct 28, 2026
CVE Published
via OSV·06:59 PM
Data Sourced
via OSV·06:59 PM
DescriptionSeverityWeakness