CVE-2026-42228

GHSA-f77h-j2v7-g6mw — n8n 未认证聊天执行劫持 CVE: CVE-2026-42228 严重性: 高 受影响版本: n8n 1.123.32 修复版本: n8n 1.123.32 / 2.17.4 / 2.18.1 漏洞概述 chat-service.ts :: startSession 接受来自 WebSocket 查询字符串的 executionId，并且仅检查该执行是否存在于数据库中。它从未验证调用者是否有权访问该执行。 知道（或能够枚举）处于 等待 状态的有效数字执行 ID 的未认证攻击者可以： 1. 无需凭据即可连接到 /chat WebSocket。 ...

CVE-2026-82475

iFlytek astron-agent through 1.1.1 is affected by an authorization bypass in the copyFlow endpoint , which fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers to overwrite other tenants' workflows or copy private workflows to read their definitions, re...

CVE-2026-82475 iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitio...

CVE-2026-82475 iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitio...

CVE-2026-82475 iFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check

iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authenticated attackers can enumerate workflow identifiers and overwrite other tenants' workflows or copy private workflows to read their definitio...