n8n: Cross-User Agent Chat Resume Allows Hijacking Another User's Pending Tool Approval

Impact

The endpoint that resumes a suspended agent tool call accepted a run identifier from the request body without checking that the checkpoint belonged to the caller. Two sibling read endpoints were scoped to the project rather than to the user, so any member of that project could list another member's private agent conversations, read them in full, and then answer a pending approval on their behalf. The tool ran and its result was written into the victim's own conversation.

Patches

The issue has been fixed in n8n versions 2.42.0 and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Disable the Agents module if it is not required by removing it from N8N_ENABLED_MODULES.
• Limit team project membership to the minimum set of users who require access to shared agents.
• Avoid using tools with "Require approval" enabled on agents accessible to multiple project members until the instance is patched.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.