n8n, an open-source platform designed for workflow automation, recently addressed a security flaw that could have significant implications for how automated processes are managed. This vulnerability, identified as CVE-2026-86077, presented a way for unauthorized individuals to bypass critical approval steps within various workflows.
Imagine a workflow where certain actions require human review or specific conditions to be met before proceeding. This flaw essentially allowed these safeguards to be circumvented, potentially leading to unintended operations or data processing without the necessary authorization. The root of the problem was found in how n8n handled “resume tokens” via its chat WebSocket route. The system failed to properly check if the intended target node for a workflow resume actually supported chat messages, creating an opening for abuse.
CVE Details
- Product: n8n
- Published: September 8, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
This vulnerability impacts versions of the n8n platform prior to 2.37.7 and also those before 2.38.2. If your n8n installation is running any version earlier than 2.37.7 or 2.38.2, it is exposed to this risk.
Current Status
The vulnerability CVE-2026-86077 has been thoroughly analyzed, and its implications are well understood. Fortunately, the developers have already provided solutions to address this issue.
Severity Level
Assigned a CVSS score of 6.5, CVE-2026-86077 is classified as a Medium severity vulnerability. While it does not allow an attacker to take complete control of your system, the ability to bypass approval gates in workflows can lead to serious operational disruptions, unauthorized actions, or data inconsistencies. It undermines the integrity of automated processes and the trust placed in them.
Possible Solutions
For all n8n users, the most critical step is to update your installations without delay. The developers have released patches that fix this vulnerability in versions 2.37.7 and 2.38.2. It is strongly recommended that you upgrade your n8n instance to one of these versions or any newer release as soon as possible. Implementing regular software updates is a fundamental practice for maintaining a strong security posture against known vulnerabilities.
References
https://github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
https://github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
https://github.com/n8n-io/n8n/security/advisories/GHSA-35jj-42hp-8gmq
