n8n Chat Hub: a chat-only role could register code-running tools

01What happened

n8n published 15 security advisories on October 14, 2026, one of them a Chat Hub role bypass rated Moderate at CVSS 5.3. The reporters credited across the batch include sm1ee and momenashrafff, and n8n's own security maintainers published the advisories. The highest rated flaw in the batch, a crafted workflow ID that reached Data Tables in other projects, is rated High at CVSS 7.2.

02How it works

Tool restrictions in Chat Hub rested on a block list that named only a small set of tool types. Users with the chat user role cannot create or edit workflows, but the gap let them register tools that run code in the task runner sandbox, read and write files in directories n8n allows, and use the instance's workflows, Data Tables and agents. Running those tools through a chat then performed the actions, so the role's limits no longer held.

03Who is affected

Self-hosted n8n instances below 1.123.85, 2.43.5 and 2.44.1 with Chat Hub in use and the global:chatUser role assigned. The path matters most where that role is given to people who are not fully trusted, which is the condition n8n names in its workarounds.

04What to do

Upgrade n8n to 1.123.85, 2.43.5 or 2.44.1, which n8n says fully remediates the issue. Until then n8n advises withholding the global:chatUser role from users who are not fully trusted, disabling Chat Hub when it is not needed, and removing high-risk node types with the NODES_EXCLUDE environment variable. The other advisories in the batch name different patched versions, listed below.

Questions people ask

Which n8n versions fix the Chat Hub tool registration bypass?

n8n fixes the Chat Hub tool registration gap in 1.123.85, 2.43.5 and 2.44.1, and says upgrading fully remediates it. Instances on an older release can withhold the global:chatUser role from users who are not fully trusted, disable Chat Hub when it is unused, or drop high-risk node types with the NODES_EXCLUDE environment variable, which n8n describes as temporary measures only.

Do the n8n CVEs published on October 14 cover this advisory batch?

No. The CVE records published on October 14 and 15, 2026, including CVE-2026-110850, point back to n8n advisories from September 30 that were fixed in 2.41.4 and 2.42.1. Every October 14 advisory checked here, including the Chat Hub and Data Tables ones, lists no known CVE, so tracking n8n by CVE alone misses them.

What else did n8n fix on October 14, 2026?

n8n's October 14 batch also covers credential exposure and cross-project access. Three nodes, Git, MongoDB Atlas Vector Store and Google Cloud Storage, stored credential secrets in execution error data. A project editor could inherit a colleague's identity through an error workflow, an unauthenticated caller could redirect a Slack workspace token through the Slack Trigger webhook, and a crafted workflow ID reached Data Table rows in every project.

How can an n8n admin tell whether the chat role is in use?

An n8n admin can check which accounts hold the global:chatUser role and whether Chat Hub is enabled, since both conditions are needed for this path. n8n also suggests auditing project memberships for the credential flaws in the same batch, and reviewing each workflow's errorWorkflow setting for values a colleague did not set.

Sources 7 links, all fetched

1. 1github.comChat Hub Advisory
2. 2github.comData Tables Advisory
3. 3github.comCredentials In Errors
4. 4github.comError Workflow Theft
5. 5github.comSlack Trigger Advisory
6. 6github.comAgent Node Credentials
7. 7github.comCVE-2026-110850 Record