n8n: Chat Hub: chat-only users can register tool types the product already tries to sandbox

Impact

Chat Hub blocked only a few tool types for users with the chat user role. A chat user cannot create or edit workflows, but could still add Chat Hub tools that run code in the task runner sandbox, read and write files in the directories that n8n allows, or use the workflows, Data Tables and agents of the instance, and then run these tools through a chat. A chat user could therefore act beyond the limits of their role.

Patches

The issue has been fixed in n8n versions 1.123.85, 2.43.5, and 2.44.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Do not assign the global:chatUser role to any user who is not fully trusted until the instance is patched.
• Disable Chat Hub if it is not required.
• Use the NODES_EXCLUDE environment variable to remove high-risk node types from the instance if they are not needed.
• Enable N8N_SSRF_PROTECTION_ENABLED=true to reduce the impact of outbound request abuse.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.