Six n8n CVEs on the agent and MCP paths: tool-approval hijack, prototype pollution, Git-node RCE, and credential exfil

Vulnerability · n8n · HIGH

Incident dateNot stated

DisclosedSep 30, 2026 (GitHub advisories on n8n-io/n8n). Vendor community security update Oct 1, 2026. VulnCheck/NVD CVE records published Oct 14, 2026. CCCS AV26-1044 Oct 15, 2026. Fixed builds released Sep 29–30, 2026 (npm timestamps). Added here as a backfill on Oct 15, 2026.

Added hereOct 15, 8:35 PM ET

Last verifiedOct 15, 2026

Summary

n8n, the open-source workflow and AI-agent builder, published a cluster of GitHub security advisories on Sep 30, 2026 for flaws that sit on its Agents and MCP surfaces. VulnCheck later assigned six CVE ids that landed in NVD on Oct 14, 2026. The highest-scoring ones are CVE-2026-110842 (CVSS 4.0 7.7 High): a member with only a read grant can abuse the MCP workflow-validation interpreter's prototype pollution to take over an owner account that lacks MFA; and CVE-2026-110845 (7.7 High): the Git node's Log operation skipped the usual strip of a repository's local git config, so pointing the node—including as an agent tool—at a repo whose config the attacker controls runs programs as the n8n process user. CVE-2026-110850 (7.2 High) lets an editor of a shared workflow pull the owner's agent-tool credentials because the save-time credential check missed ids stored in agent node parameters. Medium issues cover cross-user agent chat resume and tool-approval hijack (CVE-2026-110841, 6.1), cross-project Agents create ownership transfer (CVE-2026-110851, 6.1), and unauthenticated workflow execution via dynamic-path webhook, form, and MCP route resolution that matched on path alone (CVE-2026-110852, 6.3). n8n fixed them in 1.123.83 (1.x), 2.41.4 (stable 2.41 line), and 2.42.1 (2.42.x; 110841 also lists 2.42.0). The vendor's Oct 1 community security update says cloud instances are patched automatically, and Canada's CCCS advisory AV26-1044 (Oct 15) points operators at those builds. The advisories and patches shipped before the public CVE records. We found no report that these six CVEs are being exploited.

Severity

HIGH High (VibeIncidents editorial rating; top VulnCheck CVSS 4.0 scores are 7.7). Several of the flaws need only a low-privilege member on a shared instance, one reaches owner-account takeover without MFA, one is RCE as the n8n process user via the Git node (usable as an agent tool), and one lets an unauthenticated caller hit dynamic-path webhook/form/MCP routes. Not Critical on our scale: most paths need an existing account or project membership, cloud instances were auto-patched per the vendor, and we found no exploitation reports.

Timeline

Sep 29–30, 2026
Fixed builds land on npm: 1.123.83, 2.41.4, 2.42.0 (for CVE-2026-110841) and 2.42.1.
Sep 30, 2026
n8n publishes the six GitHub advisories (GHSA-p3pg, GHSA-5jr4, GHSA-x8wx, GHSA-x25p, GHSA-2r5r, GHSA-4c7j) on the n8n-io/n8n repo.
Oct 1, 2026
n8n posts its bi-weekly community security update listing the advisories and the fixed versions, and says cloud instances are patched automatically.
Oct 14, 2026
VulnCheck publishes the six CVE records; NVD lists them as Deferred.
Oct 15, 2026
Canada's CCCS publishes advisory AV26-1044 pointing operators at builds before 1.123.83 / 2.41.4 / 2.42.1.

How it happened

All six sit on n8n's Agents and MCP surfaces. CVE-2026-110841 (GHSA-p3pg): the agent chat resume endpoint accepted a run id without checking the suspended checkpoint belonged to the caller, and project-scoped sibling reads let any project member list and read another member's agent chats, then answer a pending tool approval so the tool ran and wrote into the victim's conversation. CVE-2026-110842 (GHSA-5jr4): the MCP workflow-validation tool evaluates caller-supplied code in-process through an interpreter that reads inherited properties and allows assignment onto shared prototypes, so a read-grant member can make a permission check return truthy and take over a non-MFA owner account. CVE-2026-110845 (GHSA-x8wx): the Git node strips hostile local git config before most operations but not Log, which invokes an external program; usable as an agent tool. CVE-2026-110850 (GHSA-x25p): when an editor saves a shared workflow, the credential check inspected node.credentials but missed agent model and tool credential ids in parameters, so an editor could resolve the owner's secrets through tools they control. CVE-2026-110851 (GHSA-2r5r): Agents create accepted a client-supplied id and updated an existing row without checking which project owned it. CVE-2026-110852 (GHSA-4c7j): dynamic-path webhook, form and MCP resolution matched on path alone, so omitting the unguessable id still executed the workflow unauthenticated (node-level auth still applies).

How to check your app

Upgrade self-hosted n8n to 1.123.83 or later on the 1.x line, 2.41.4 or later on 2.41.x, or 2.42.1 or later on 2.42.x (or current latest; npm latest was 2.43.6 as of Oct 15, 2026).
If you run n8n Cloud, the Oct 1 vendor update says instances are patched automatically — confirm your build.
Until patched: restrict the instance to fully trusted users; enable MFA on owner and admin accounts (limits the 110842 takeover path); disable Agents or instance MCP if unused; turn on node-level auth on dynamic-path webhooks; consider NODES_EXCLUDE for the Git node; audit shared workflows that use inline Message an Agent nodes.

Sources

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.

If n8n agents or MCP tools talk to apps you ship, LockedVibe's free Lockdown Pack puts safer defaults in the repo, and its $99 scan looks for exposed secrets and auth gaps in one app. LockedVibe is our sister company (same owner) and has no say over this entry. Disclosure.