GHSA-jh8h-6c9q-7gmw

What it actually does

The Chat Trigger node in n8n fails to consistently enforce configured authentication on its chat/webhook interface. An unauthenticated requester can reach a workflow that operators believed was protected, send chat input into that workflow, and receive the workflow’s responses. Impact is confined to Chat Trigger–backed workflows that have authentication enabled; it does not by itself grant n8n editor, credential-store, or host access. Successful abuse can still cause unauthorized workflow execution and exposure of whatever data or actions that workflow is designed to handle.

Why it matters to the business

Chat-based automations that were meant to be restricted (customer support bots, internal assistants, intake forms wired to downstream systems) can be invoked by outsiders. That can leak conversation content or connected-system data, trigger unintended business processes, or generate noisy/abusive load on integrations. Severity is moderate (CVSS 4.8), the issue is not in CISA KEV, and no public exploit maturity is reported, so mass opportunistic exploitation is less likely than for critical n8n flaws—but any internet-reachable Chat Trigger with auth enabled remains an unauthorized-access path until upgraded. The advisory is months old, so unpatched instances represent lingering avoidable exposure rather than an emergency zero-day.

How an attack unfolds

An attacker finds an n8n instance that publishes a Chat Trigger endpoint (often via a public webhook/chat URL). They determine that the node is configured to require authentication, then send chat or webhook requests that omit or skip the expected auth checks. Because the node does not fully gate the chat interface, the request is accepted, the associated workflow runs with the attacker-supplied messages, and any reply or side effect (notifications, CRM writes, ticket creation, LLM calls, data lookups) occurs as if a legitimate user had authenticated. Follow-on harm depends entirely on what that workflow is allowed to do; the bypass itself is unauthorized use of the chat entry point, not a full product takeover. No named threat actors or ransomware campaigns are associated with this issue.

How to fix it

Upgrade n8n (npm) to a fixed release: 1.123.22 (1.x line), 2.9.3, or 2.10.1 or later on the corresponding 2.x line. After upgrading, restart n8n so Chat Trigger nodes load the patched auth handling, then re-save or republish affected workflows if your process requires it. Until the upgrade is complete, restrict network access to Chat Trigger/chat webhook URLs (VPN, reverse-proxy allowlists, or disable public access), and temporarily disable or unpublish Chat Trigger workflows that must not accept unauthenticated input. Do not treat Chat Trigger authentication as a security boundary on unpatched versions.

How to confirm the fix worked

Confirm the running n8n package version is 1.123.22, 2.9.3, 2.10.1, or newer (`npm ls n8n` / image tag / about page). Inventory active workflows that use a Chat Trigger with authentication enabled and verify those endpoints reject unauthenticated chat and webhook requests (expect 401/403, not a chat session or workflow run). Review reverse-proxy and n8n webhook logs for pre-upgrade successful unauthenticated hits to chat trigger paths. In a staging clone, enable Chat Trigger auth and confirm anonymous access is denied after the upgrade without changing workflow logic.

Typical attack path

1. Discover an internet- or network-reachable n8n deployment that exposes a Chat Trigger or chat webhook URL.
2. Confirm the Chat Trigger is intended to require authentication (login, basic auth, or similar).
3. Submit chat or webhook traffic that does not present valid credentials yet is still processed by the node.
4. Interact with the running workflow through the chat interface to elicit data or cause downstream actions.
5. Repeat or automate messages against high-value workflows (support, ops, data lookup) if the endpoint remains unpatched.

How to detect it

This issue has no public exploit maturity and no attributed actors, so look for unauthorized use of Chat Trigger endpoints rather than a known malware family. Review n8n execution history and webhook/chat access logs for Chat Trigger workflows that have authentication enabled but show successful runs or 200-class chat responses with missing, empty, or failed credentials. Correlate reverse-proxy logs (paths serving n8n webhooks/chat) with n8n’s own execution records: successful workflow starts without a matching successful auth event are the primary signal. Hunt for bursts of chat messages, unusual source IPs, or executions outside business hours on customer-facing or internally sensitive chat workflows. Preserve pre-upgrade logs; post-upgrade, unauthenticated attempts should fail and can be used as a baseline of scanning activity.

• n8n Chat Trigger webhook/chat URL paths under /webhook/ returning success without an Authorization or session cookie
• workflow executions for Chat Trigger nodes with authentication enabled and no corresponding successful auth event
• HTTP 200 responses to n8n chat/webhook endpoints from unauthenticated clients that should have received 401 or 403
• repeated POST traffic to n8n webhook or chat endpoints with empty or omitted credential headers
• source IPs hitting Chat Trigger URLs that never appear in n8n editor or user-login logs

What your security team should do

• Patch all n8n installs to 1.123.22, 2.9.3, or 2.10.1+ as a standard vulnerability cycle item—not an emergency KEV action, but do not leave Chat Trigger auth-enabled instances on older builds.
• Immediately inventory and network-restrict publicly reachable Chat Trigger / chat webhook URLs; unpublish or disable any that must not accept anonymous traffic.
• Treat Chat Trigger authentication as untrusted on unpatched versions; add an upstream authenticating proxy if those chats must stay online during the upgrade window.
• After patching, re-test that unauthenticated requests to protected chat endpoints fail, and review workflow execution history for unexpected pre-patch chat runs.
• Tune detections on n8n webhook/chat access and workflow executions originating without a corresponding successful authentication event.