Cross-User Agent Chat Resume: What the September 2026 Advisory Says
What the September 30, 2026 GitHub advisory says about the cross-user agent chat resume vulnerability: what changed, who's affected, and what to do now.
Checked against the cited sources on .
Updates
On September 30, 2026, a GitHub security advisory announced a cross-user agent chat resume vulnerability affecting the n8n npm package. The advisory, titled "Cross-User Agent Chat Resume Allows Hijacking Another User's Pending Tool Approval," is the primary source for everything this article states about the issue.
We cover only what the advisory itself says about this agent chat security vulnerability: what changed, who it affects by version number, and what the advisory states as the fix and the temporary workarounds. Where the advisory stays silent, for example on n8n Cloud or other hosted plans, we say so plainly rather than guessing.
What Was Announced and When
The advisory was published on github.com on September 30, 2026, under the title naming the cross-user agent chat resume problem directly. It describes a flaw in how a shared n8n project handles a paused agent conversation that is waiting for a human to approve a tool call.
The advisory documents this AI agent chat resume flaw as an authorization gap: the system does not verify that the user resuming a chat is the same user who started it, in a project shared by multiple people.
How the Vulnerability Enables Hijacking Pending Tool Approval
According to the advisory, an attacker who has access to a shared project can read another user's private agent conversation in full. Once inside that conversation, the attacker can answer a pending approval on the victim's behalf, letting the tool run and writing its result back into the victim's own conversation thread.
We think this is a useful reminder that a human-approval step is only as strong as the identity check around it; an approval gate that anyone in a shared workspace can click is not really a gate. The advisory itself frames the exposure as hijacking pending tool approval that was never meant to be answered by anyone but the original requester.
Who and Which Versions Are Affected
The advisory lists the n8n npm package as affected before version 2.42.0 and before version 2.41.4. This cross-user agent chat resume issue therefore applies to anyone running one of those earlier builds with multiple users sharing project-level access to agents that use tool approval.
| Status | Version range | What the advisory says |
|---|---|---|
| Affected | Before 2.42.0 and before 2.41.4 | Listed as vulnerable to the cross-user chat resume issue |
| Fixed | 2.42.0 and 2.41.4 | Listed as the versions where the issue is fixed |
What to Do Now: Patching and Temporary Workarounds
The advisory states that the issue has been fixed in n8n versions 2.42.0 and 2.41.4, and it tells users to upgrade to one of those versions or later. That upgrade is the one remediation the advisory actually recommends.
For teams that cannot upgrade immediately, the advisory lists several temporary mitigations: disabling the Agents module through the N8N_ENABLED_MODULES setting, restricting instance access to trusted users, limiting who belongs to a shared project, and avoiding tools with "Require approval" enabled on agents that multiple people can reach.
In our view, the advisory's own caution matters here: it says plainly that these workarounds do not fully remediate the risk, so we would not rely on any single one of them and would treat the upgrade as the real fix rather than a nice-to-have.
What the Announcement Does Not State
The advisory does not say whether n8n Cloud or other hosted plans are affected; that question is simply not addressed in the text we reviewed. It also does not explain how long the issue existed before discovery, how many instances were exposed, or whether anyone exploited it before the fix.
- Whether n8n Cloud or other hosted plans are affected
- Whether Community and Enterprise editions differ in exposure
- How long the flaw existed before it was found
- Whether it was exploited before the fix shipped
The advisory does not state whether a CVE identifier has been assigned to this issue or give a numeric severity score; those specifics are not addressed in the findings we reviewed. In our view, not having a CVE on hand is a minor friction point for vulnerability trackers rather than a sign the issue is less serious, so teams that rely on CVE feeds should still track this one by its advisory title for now.
