CVE-2026-103260
n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node
CVSS Score
4.0
EPSS Score
0.0%
EPSS Percentile
0th
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or approval permissions, allowing unauthenticated users to advance waiting executions and trigger guarded actions.
| CWE | CWE-862 |
| Vendor | n8n-io |
| Product | n8n |
| Published | Oct 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for n8n-io n8n
Be the first to know when new medium vulnerabilities affecting n8n-io n8n are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
Low
Availability
None
Affected Versions
n8n-io / n8n
0 < 2.39.6 2.40.0 < 2.40.1
References
Credits
🔍 tr4ce-ju