n8n September 30 advisory batch: cross-user hijack of pending agent tool approvals, agent-node credential check bypass, MCP validation takeover and cross-project agent transfer

n8n instances before 2.41.4 / 2.42.1 (1.123.83 on the 1.x line per a third-party summary) with shared projects, the Agents module or the instance MCP server enabled

One record for the coordinated 30 September 2026 batch, which a third-party summary counts as 14 advisories (10 high, 4 medium); no CVE identifiers had been assigned in the advisories reviewed. The record is built around four agent-specific advisories. GHSA-p3pg-xw4f-m72c (medium): the endpoint that resumes a suspended agent tool call did not check that the checkpoint belonged to the caller, so a project member could answer another member's pending approval and the tool ran. This is why autonomy is coded copilot_with_approval. GHSA-x25p-9mr6-cwgp (high): the shared-workflow credential check did not inspect the agent node's parameter-held model and tool credential ids, so an editor could have the owner's credentials resolved for tools they control and send decrypted secrets to a destination of their choosing. GHSA-5jr4-xmvf-frmj (high): the MCP workflow-validation tool evaluates caller-supplied code through an interpreter that allows assignment onto shared prototypes; a member with only a read grant could drive this to takeover of the instance owner's account (MFA-protected accounts are not affected). GHSA-2r5r-xgvc-rj4p (medium): the Agents create endpoint accepted a caller-supplied identifier, letting a read-only user move another project's agent into their own project. The remaining advisories in the batch are not individually described here. The advisories describe vulnerabilities and fixes; no exploitation is reported. Separate from earlier n8n records, which cover different mechanisms.