All vulnerabilities
CVE-2026-118677GHSA-cwm2-vhf5-27q9

n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance

n8n-io n8nFrameworks
Open in ThreatlineRecord JSON
CVSS
5.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.42.1Also 2.41.4CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop app that allows its deep-link connect handler to silently re-pair the app with a different n8n instance. Attackers can lure users running the Local Gateway into opening a crafted n8n-computer-use:// link to connect their computer to an attacker-controlled instance, inheriting previously granted permissions and acting on the computer through the gateway.

Text from CVE List

Affected versions 4

  • n8naffected: 2.42.0 before 2.42.1CVE List
  • n8nunaffected: 2.42.1CVE List
  • n8naffected: all versions before 2.41.4CVE List
  • n8nunaffected: 2.41.4CVE List

References 2