EUVD-2026-101724

n8n before 2.41.4 and 2.42.0 contains an authorization bypass in the agent chat resume endpoint, which accepts a run identifier from the request body without verifying that the suspended checkpoint belongs to the caller. Authenticated project members can list and read other members' private agent...

CVE-2026-110841

The n8n platform (versions before 2.41.4 and 2.42.0 ) is vulnerable to an authorization bypass in the agent chat resume endpoint. The root cause is the failure to verify that a suspended checkpoint belongs to the caller when a run identifier is accepted from the request body. Authenticated projec...