CVE-2026-118677

The record

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently re-pair the app with a different n8n instance. Attackers can lure users running the Local Gateway into opening a crafted n8n-computer-use:// link to connect their computer to an attacker-controlled instance, inheriting previously granted permissions and acting on the computer through the gateway.

Affected packages

Related vulnerabilities

• CVE-2026-73335 Android application "Myna Point" is vulnerable to Improper Authorization in Handler for… CWE-939
• CVE-2026-21075 Improper authorization in handler for custom URL scheme in My Galaxy prior to version 6.3… CWE-939
• CVE-2026-21062 Authorization bypass in SemClipboardService prior to SMR Aug-2026 Release 1 allows local… CWE-939
• CVE-2026-59717 Home Assistant is open source home automation software focused on local control and… CWE-939
• CVE-2026-12189 A flaw has been found in Moovit Bus & Public Transit App 1.18 on Android. CWE-939
• CVE-2026-12190 A vulnerability has been found in Genspark AI Workspace App 2.8.4 on Android. CWE-939
• CVE-2026-53408 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version… CWE-939
• CVE-2026-53407 Improper Authorization in Handler for Custom URL Scheme in Zoom Workplace before version… CWE-939