{
 "public_id": "AIR-2026-0267",
 "incident_id": "2026-09-n8n-agent-approval-hijack-advisory-batch",
 "date_disclosed": "2026-09-30",
 "title": "n8n September 30 advisory batch: cross-user hijack of pending agent tool approvals, agent-node credential check bypass, MCP validation takeover and cross-project agent transfer",
 "attack_surface": "agent_framework",
 "initial_vector": "authenticated_low_privilege_member_abuse",
 "agent_capability_abused": [
  "agent_tool_approval_resume",
  "agent_node_credentials",
  "mcp_workflow_validation",
  "agent_ownership"
 ],
 "target_product": "n8n (Agents module, Message an Agent node, instance MCP server)",
 "target_vendor": "n8n",
 "autonomy_level": "copilot_with_approval",
 "impact_realized": false,
 "impact_type": [
  "unauthorized_tool_execution",
  "credential_exposure",
  "account_takeover",
  "unauthorized_data_access"
 ],
 "blast_radius": "n8n instances before 2.41.4 / 2.42.1 (1.123.83 on the 1.x line per a third-party summary) with shared projects, the Agents module or the instance MCP server enabled",
 "cve": [],
 "defense_present": "human tool-approval gate; shared-workflow credential check; MCP permission scopes",
 "fix_shipped": "n8n 2.41.4 and 2.42.1 (2.42.0 fixes only the approval-hijack issue)",
 "primary_sources": [
  "https://github.com/n8n-io/n8n/security/advisories/GHSA-p3pg-xw4f-m72c",
  "https://github.com/n8n-io/n8n/security/advisories/GHSA-x25p-9mr6-cwgp",
  "https://github.com/n8n-io/n8n/security/advisories/GHSA-5jr4-xmvf-frmj",
  "https://github.com/n8n-io/n8n/security/advisories/GHSA-2r5r-xgvc-rj4p",
  "https://wz-it.com/en/blog/n8n-security-update-september-2026/"
 ],
 "confidence": "high",
 "notes": "One record for the coordinated 30 September 2026 batch, which a third-party summary counts as 14 advisories (10 high, 4 medium); no CVE identifiers had been assigned in the advisories reviewed. The record is built around four agent-specific advisories. GHSA-p3pg-xw4f-m72c (medium): the endpoint that resumes a suspended agent tool call did not check that the checkpoint belonged to the caller, so a project member could answer another member's pending approval and the tool ran. This is why autonomy is coded copilot_with_approval. GHSA-x25p-9mr6-cwgp (high): the shared-workflow credential check did not inspect the agent node's parameter-held model and tool credential ids, so an editor could have the owner's credentials resolved for tools they control and send decrypted secrets to a destination of their choosing. GHSA-5jr4-xmvf-frmj (high): the MCP workflow-validation tool evaluates caller-supplied code through an interpreter that allows assignment onto shared prototypes; a member with only a read grant could drive this to takeover of the instance owner's account (MFA-protected accounts are not affected). GHSA-2r5r-xgvc-rj4p (medium): the Agents create endpoint accepted a caller-supplied identifier, letting a read-only user move another project's agent into their own project. The remaining advisories in the batch are not individually described here. The advisories describe vulnerabilities and fixes; no exploitation is reported. Separate from earlier n8n records, which cover different mechanisms.",
 "verified_quote": "any member of that project could list another member's private agent conversations, read them in full, and then answer a pending approval on their behalf",
 "class": "responsible_disclosure",
 "date_occurred": null,
 "defense_bypassed": true,
 "taxonomy": {
  "owasp_asi": [
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "advisory_batch",
   "approval_hijack",
   "cross_tenant",
   "credential_check_bypass",
   "prototype_mutation",
   "mcp_server"
  ]
 },
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Unauthorized Access & Account Takeover",
 "risk_sub_secondary": [],
 "ai_entity": "generative",
 "agency": "ai_as_target",
 "agency_debatable": true,
 "agency_reason": "authorization flaws in an automation platform, several in the agent tool-approval path; contested because the agent's approval gate is the target",
 "vector_family": "other",
 "vector_detail": "authenticated_low_privilege_member_abuse",
 "guardrail_kind": [
  "human_approval",
  "permission_scope"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI03",
 "agent_framework": "unknown",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "unknown",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [
  "credential_theft"
 ],
 "eai_reason": "subcategory: Unauthorized Access & Account Takeover",
 "asi_curated": [],
 "asi_scope": "in_scope",
 "asi_provenance": "rule",
 "asi_reason": "ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}