{"schema":"threatline.record/2","record":{"id":"GHSA-cwm2-vhf5-27q9","aliases":["GHSA-cwm2-vhf5-27q9"],"summary":"Local Gateway Deep-Link Connect Silently Re-pairs to Attacker-Controlled Instance","details":"## Impact\n\nThe Local Gateway desktop app could be made to connect to another n8n instance without the user's confirmation, and permissions the user had already granted carried over to that instance. An attacker who gets a user to open a crafted link could connect the user's computer to an instance the attacker controls and act on it through the gateway.\n\nThe victim must have the Local Gateway app installed and running and must open a crafted link.\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.42.1 and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Do not open unsolicited links using the `n8n-computer-use://` scheme.\n- Quit the Local Gateway app when it is not actively in use to reduce the window of exposure.\n- Restrict the `allowedOrigins` setting to the specific instance URL the Gateway is paired with, rather than relying on the default wildcard.\n- Disable the Computer Use / Local Gateway feature if it is not required.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-cwm2-vhf5-27q9","source_modified_at":"2026-10-14T09:43:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.42.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-cwm2-vhf5-27q9","source_modified_at":"2026-10-14T09:43:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.41.4"}],"fixed_versions":[],"cvss":5.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-14T09:43:30Z","modified_at":"2026-10-14T09:43:30Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-cwm2-vhf5-27q9","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T09:43:30Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T09:43:30Z","content_hash":"c48e17c4cb6e64974fd3ad28445ecd40f1d27faa2e091226351b829cd05b7425"}}