Redbot Labs / Threat Intelligence
n8n Vulnerability Allows Anonymous Users to Bypass Workflow Approval Gates
- Incident ID
- RBT-TI-0095
- Organization
- n8n
- Reported Location
- Berlin, Germany Vendor Location; No Confirmed Victim Location Disclosed
- Severity
- Medium
- Category
- AI Workflow Security / Human Approval Bypass
- Record Date
- 2026-09-02
Incident Summary
Approval bypass. n8n disclosed CVE-2026-86077, a flaw allowing an anonymous participant to resume certain workflows waiting for human authorization.
Scope. This is a workflow authorization vulnerability relevant to AI-enabled automation; exploitation does not require an AI model.
What Happened
Token reuse across interfaces. A token supplied to an anonymous form submitter could be reused through the chat WebSocket. The route failed to verify that the paused node was chat-capable.
Unapproved continuation. In affected configurations, this allowed execution to pass a non-chat approval gate.
Remediation. n8n fixed the issue in versions 2.37.7 and 2.38.2 by restricting which node types the chat interface could resume. Technical advisory
Affected Systems
n8n Workflows Combining Public Form Submission with Non-Chat Approval Gates
Attack Vector
Missing Authorization / Cross-Interface Token Reuse / Workflow Approval Bypass
Business Impact
Lost authorization control. A workflow could continue without its intended reviewer’s approval. Actual consequences depend on downstream actions and permissions.
Evidence limits. The advisory does not identify compromised organizations, confirmed losses, or active exploitation. Reported impact
Redbot Analysis
Human approval must be enforced technically. Redbot Labs assesses that a visible approval step provides limited protection unless the underlying application verifies who authorized the action and which execution that authorization covers.
Possession of a token is not sufficient authorization. A token issued for one interaction should not grant permission to advance an unrelated workflow stage. Validation should bind authorization to the intended user, action, node, and execution.
Test every path that can resume work. Security validation should examine chat interfaces, webhooks, forms, callbacks, and APIs for alternate ways to advance a paused workflow.
Limit downstream authority. Workflows should use narrowly scoped credentials so that a failed approval control does not expose every connected system. Audit records should connect consequential actions to a verifiable approval decision.
Sources
n8n — Company information and vendor location
