CVE-2026-110846

— UNSCOREDpublic exploit available

Published 2026-10-14 · Updated 2026-10-14

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, running downstream actions under the workflow owner's credentials, potentially including command execution.

Weaknesses

CWE-180

Public exploit & PoC references

https://github.com/n8n-io/n8n/security/advisories/GHSA-728h-pmr2-7cgh

All references

https://github.com/n8n-io/n8n/security/advisories/GHSA-728h-pmr2-7cgh
https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-send-and-wait-hmac-signature-bypass-via-waiting-webhook

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2026-100230PoC
HIGHCVE-2026-100409PoC
MEDIUMCVE-2026-100547PoC
MEDIUMCVE-2026-100674PoC
MEDIUMCVE-2026-102269PoC
UNSCOREDCVE-2026-105050PoC
UNSCOREDCVE-2026-93326PoC
MEDIUMCVE-2026-95811

Related by shared AI tags and CWE weakness class. Browse the full archive.