n8n Chat Hub CVE-2026-118640

Exploitation requires an authenticated account holding the global:chatUser role on an n8n instance where Chat Hub is enabled/in use; the attacker then registers Chat Hub tool types that the product only partially blocked for that role. This is NOT remote-unauthenticated: the global:chatUser assignment (PR:L) is the gating prerequisite, which is why the vendor's mitigations center on not granting that role to untrusted users, restricting instance access to trusted users, disabling Chat Hub when unneeded, excluding high-risk nodes via NODES_EXCLUDE, and enabling N8N_SSRF_PROTECTION_ENABLED=true. Impact is further limited to what the task-runner sandbox and n8n's permitted directories allow, and to the instance's existing workflows, Data Tables and agents. Affected deployments are n8n before 1.123.85, before 2.43.5, and before 2.44.1.

This is a medium-severity authorization-bypass (CWE-863) scored CVSS 4.0 5.3. The vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N tells a consistent story: network-reachable and low-complexity, but it requires an already-authenticated principal (PR:L) - specifically a user holding the global:chatUser role - and yields only Low confidentiality and Low integrity impact with no availability impact. No EPSS probability was supplied in the input, there is no CISA KEV listing, and no verified exploit code is present (the two references are the n8n GHSA and the VulnCheck advisory, not PoC/exploit code), so the status is no public exploit identified at time of analysis. The vuln.today priority is 'this_month', not act_now/emergency, which aligns with a signal profile of a bounded privilege-escalation-within-role issue rather than a widely weaponized remote flaw. The practical risk is an over-privileged insider or a compromised chat-only account escaping role limits - the chat user cannot create/edit workflows yet can run Chat Hub tools that execute code in the task-runner sandbox and reach files, workflows, Data Tables and agents. Note the low CVSS impact scores reflect that execution is still constrained to the n8n sandbox and permitted directories, not full host compromise; treat this as a real but scoped priority best resolved within a normal patch cycle, prioritized higher where untrusted users hold global:chatUser.

An authenticated user assigned only the global:chatUser role - intended to be restricted to chatting - opens Chat Hub and registers a tool type that was supposed to be blocked for their role, then runs it through chat to execute code in the task-runner sandbox and reach instance workflows, Data Tables, agents and permitted files. Because the attack is network-based and low-complexity but needs that existing chat-user account (PR:L), it is realistic for insiders or anyone who obtains chat-user credentials. No verified public exploit code is available at time of analysis.