An n8n Chat Trigger authentication exception intended for hosted setup applied to embedded chat sessions configured for user authentication. The attacker needed the relevant endpoint and in some cases a known session identifier; the issue was not an arbitrary n8n administrator login bypass. The endpoint could expose existing conversation history and…
Inspect the ClaimsCase · DiggingBeagle record
n8n embedded Chat Trigger setup bypassed configured user authentication
An n8n Chat Trigger authentication exception intended for hosted setup applied to embedded chat sessions configured for user authentication. The endpoint could expose existing conversation history and initiate configured workflow behavior without the intended chat-user credential check.
Scope
The attacker needed the relevant endpoint and in some cases a known session identifier; the issue was not an arbitrary n8n administrator login bypass. Impact depends on the specific Chat Trigger mode and embedded workflow permissions; no real victim count is documented.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
The cited primary technical report or advisory supports the stated mechanism within its reported scope. The assessment does not infer a production breach, a victim count or a comparable impact score from a laboratory result. A maintainer or advisory names a patched release; that does not prove every deployed instance has updated. Boundary: An authentication rule that covers normal chat messages but exempts setup GET requests leaves the privacy policy dependent on endpoint and chat mode.
Assessed Oct 29, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP23-N8N-CHAT-AUTH-SETUP-1 · CLM-ENRICH-20261029-20 · n8n embedded Chat Trigger authentication advisory
At a glance
The endpoint could expose existing conversation history and initiate configured workflow behavior without the intended chat-user credential check.
Read the implicationsImpact depends on the specific Chat Trigger mode and embedded workflow permissions; no real victim count is documented.
Limits and uncertaintyFull account
An n8n Chat Trigger authentication exception intended for hosted setup applied to embedded chat sessions configured for user authentication.
The attacker needed the relevant endpoint and in some cases a known session identifier; the issue was not an arbitrary n8n administrator login bypass. The endpoint could expose existing conversation history and initiate configured workflow behavior without the intended chat-user credential check.
Impact depends on the specific Chat Trigger mode and embedded workflow permissions; no real victim count is documented. Upgrade to a patched version and enforce the configured identity check for setup requests, history reads and workflow invocations in all chat modes.
Evidence interpretation and control boundary. An authentication rule that covers normal chat messages but exempts setup GET requests leaves the privacy policy dependent on endpoint and chat mode. History access still requires a reachable embedded Chat Trigger and, for some operations, a known session identifier; neither condition is an administrator-login bypass. Validate the configured user authentication on setup, history and tool-effect paths rather than on one visible UI action.
Mechanism and trust boundary
- 01
Step
- 02
Step
- 03
Step
Claims & evidence
CLM-ENRICH-20261029-20The n8n advisory reports that an exception intended for hosted chat setup also covered embedded Chat Trigger sessions configured for user authentication, exposing history or workflow actions under specific conditions.supported
Basis: reported finding
- supportsn8n embedded Chat Trigger authentication advisoryprimary disclosure
GHSA-pwj5-wwm6-g83j: embedded/hosted mode distinction, GET setup and affected versions
CLM-CP23-N8N-CHAT-AUTH-SETUP-1An n8n Chat Trigger authentication exception intended for hosted setup applied to embedded chat sessions configured for user authentication. The attacker needed the relevant endpoint and in some cases a known session identifier; the issue was not an arbitrary n8n administrator login bypass. The endpoint could expose existing conversation history and initiate configured workflow behavior without the intended chat-user credential check.supported
Basis: reported finding
- supportsn8n embedded Chat Trigger authentication advisoryprimary disclosure
GHSA-pwj5-wwm6-g83j: embedded/hosted mode distinction, GET setup and affected versions
Implications
The endpoint could expose existing conversation history and initiate configured workflow behavior without the intended chat-user credential check.
Controls and mitigations
- Upgrade to a patched version and enforce the configured identity check for setup requests, history reads and workflow invocations in all chat modes.
Unknowns and contradictions
- Impact depends on the specific Chat Trigger mode and embedded workflow permissions; no real victim count is documented.
Sources and citation
Material revision history
- Oct 29, 2026 · Canonical change recorded · new in release · revision 202