https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-04T00:04:53.511420+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-86077 CVE-2026-86077 — n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket 2026-10-04T00:04:53.512935+00:00

Affected: n8n-io n8n

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the chat route to release a Send-and-Wait, non-chat HITL, or Wait approval gate. The affected authorization logic is packages/cli/src/chat/chat-execution-manager.ts, where canResumeOverChat did not gate the resume target. This issue is fixed in versions 2.37.7 and 2.38.2.