4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-jh8h-6c9q-7gmw

GHSA-jh8h-6c9q-7gmw: n8n has an Authentication Bypass in its Chat Trigger Node

Impact

When the Chat Trigger node is configured with n8n User Auth authentication, the authentication check could be circumvented.

This issue requires the Chat Trigger node to be configured with n8n User Auth authentication (non-default).

Patches

The issue has been fixed in n8n versions 2.10.1, 2.9.3, and 1.123.22. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Limit workflow creation and editing permissions to fully trusted users only.
Use a different authentication method for the Chat Trigger node, or restrict network access to the webhook endpoint to trusted origins.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-jh8h-6c9q-7gmw

GHSA-jh8h-6c9q-7gmw:

4.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
n8n	npm	< 1.123.22	1.123.22
n8n	npm	>= 2.0.0, < 2.9.3	2.9.3
n8n	npm	>= 2.10.0, < 2.10.1	2.10.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the Chat Trigger node when it is configured to use n8n User Auth. The analysis of the security patches, specifically commits 9e5212ecbc5d2d4e6f340b636a5e84be6369882e, 1479aab2d32fe0ee087f82b9038b1035c98be2f6, and 062644ef786b6af480afe4a0f12bc6d70040534a, reveals that the validateAuth function in packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/GenericFunctions.ts is the root cause. The original implementation of this function only checked if the n8n-auth cookie was present, without verifying its signature or content. This flaw allowed an unauthenticated user to bypass security checks by simply sending a request with an n8n-auth cookie containing an arbitrary value. The patch rectifies this by introducing a call to context.validateCookieAuth, which properly validates the JWT token from the cookie against the application's AuthService.

Vulnerable functions

validateAuth

packages/@n8n/nodes-langchain/nodes/trigger/ChatTrigger/GenericFunctions.ts

The `validateAuth` function was vulnerable because when `authentication` was set to `n8nUserAuth`, it would check for the presence of an `n8n-auth` cookie but failed to validate the cookie's contents. This allowed an attacker to bypass authentication by providing a cookie with any value. The patch adds a call to `context.validateCookieAuth(authCookie)` to properly verify the token.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.