n8n CVE-2026-103260

Exploitation requires that a target n8n workflow uses the Send and Wait node configured in 'Approve Within Chat' mode, with an execution actively suspended and awaiting approval at the time of attack (this is the AT:P attack requirement and the primary limiting factor). No authentication is required (PR:N) and no user interaction is needed (UI:N); the attacker submits a resume request that is accepted without any verification of requester identity or approval permission. Limiting factors beyond the required node/mode: impact is integrity-only (VI:L, scope unchanged) and confined to advancing that specific waiting execution and whatever downstream action it guards - instances not using Send-and-Wait approvals, or not currently in a waiting state, are not exposed. Upgrading to n8n 2.39.6 or 2.40.1 removes the condition.

The CVSS 4.0 base score of 6.3 (MEDIUM) reflects a network-reachable, low-complexity, unauthenticated (PR:N/UI:N) integrity-only flaw with an attack requirement (AT:P) and no confidentiality or availability impact (VC:N/VI:L/VA:N). The AT:P requirement is the critical qualifier: exploitation presupposes a workflow using the Send and Wait node specifically in 'Approve Within Chat' mode with an execution actively suspended and waiting for approval - not a generic attack surface against every n8n instance. CWE-862 (missing authorization) is the accurate root cause: resume requests are accepted without verifying the requester's identity or approval permission. No EPSS score, CISA KEV listing, or public POC is present in the supplied data, so per precision rules this is 'no public exploit identified at time of analysis.' A vendor patch (n8n GHSA-342v-gmh6-738j, VulnCheck advisory) is confirmed available. Net assessment: a legitimate but bounded authorization-bypass bug whose real-world risk is gated by a non-default node/mode and the business sensitivity of whatever action the approval guards - it is a patch-on-schedule issue, not an emergency, and the MEDIUM rating is appropriate rather than inflated. The integrity-only, scope-unchanged impact means consequences are confined to advancing a specific waiting execution, not broad compromise.

An organization builds an n8n workflow that pauses on a Send and Wait node in 'Approve Within Chat' mode before executing a guarded action (e.g., releasing a payment, provisioning access, or publishing content). An unauthenticated remote attacker who learns or guesses the resume endpoint submits a crafted resume/approval request; because identity and approval permission are never checked, the suspended execution advances and the guarded action fires as if a legitimate approver authorized it. No public exploit code is identified at time of analysis.