n8n Anonymous Approval-Gate Bypass via Reused Chat resumeToken

Technical Analysis

The `/chat` WebSocket endpoint resumes a paused execution using a resume token but failed to verify that the paused node was actually a chat-capable node type before honoring the resume request. Because n8n distributes resume tokens to anonymous form submitters as part of normal Form Trigger workflows, an attacker with no authenticated account could capture or guess a token and present it over the chat route to resume executions paused at unrelated approval-gate nodes (Send-and-Wait, HITL integrations, plain Wait nodes). This effectively lets an anonymous, low-privilege actor cross a trust boundary between the low-assurance chat/form input path and high-assurance human-approval workflow control, causing the automation to proceed as though a human authorized it. The impact is a broken authorization/human-in-the-loop control rather than direct code execution, but it can trigger irreversible or sensitive downstream actions gated behind approval logic.

Affected Systems

n8n

Detection Signatures

• Look for chat WebSocket resume requests targeting non-chat node execution IDs
• Audit logs for workflow executions transitioning from 'waiting' to 'completed' state without a corresponding approval callback (email click, Slack button, Telegram reply)
• Monitor for resume tokens issued via Form Trigger being replayed against the /chat endpoint
• Unexpected completion of Send-and-Wait / Wait nodes shortly after anonymous form submissions on the same instance

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 2.37.7, 2.38.2, or later, which restricts chat-route resume to chat-capable node types only.

2. 2

   Restrict instance access

   Limit access to n8n instances to authenticated, trusted users, especially instances exposing Form Triggers publicly.

3. 3

   Segregate workflow patterns

   Avoid combining Form Trigger nodes with non-chat approval gates (Send-and-Wait, Telegram/Slack/Gmail HITL, Wait nodes) in the same publicly accessible workflow until patched.

4. 4

   Audit execution history

   Review recent executions of approval-gated workflows for completions lacking a legitimate approval callback, indicating possible exploitation.

5. 5

   Rotate and scope tokens

   Treat resume tokens as sensitive credentials; ensure tokens are single-purpose and cannot be replayed across different node types or routes.