n8n's Chat Role Could Register Tools. npm Moved First.

n8n's advisory GHSA-43v8-hjhm-chjp, published by CharlieKolb at 09:43 UTC on 14 October 2026, says a chat-only user could register Chat Hub tools the product already tries to sandbox. GitHub labels the advisory Moderate. The page lists no CVE id. The CVSS 4.0 vector on the page is network, low complexity, low privileges, no user interaction, and low confidentiality and integrity on the vulnerable system, with no availability loss and no subsequent-system impact.

Hacker News tonight had no n8n row. US X trends at 22:20 UTC were sports, celebrity, and politics. BleepingComputer's feed today led with Nextcloud, Android scam defenses, and a fake Arch package set. Reuters in this window had no new operator control failure. Junie CLI's MCP trust check is a separate brief, published the next day as a CVE. This one is the chat role.

Medium Medium because n8n describes a role that could register tools, and because those tools still run in the task runner sandbox with file access limited to directories n8n allows. The advisory does not claim an unsandboxed shell on the host. It also does not name a discovery date, so the only clocks on the page are the package and the note.

The role did not hold the tool list.#

n8n says Chat Hub blocked only a few tool types for users with the chat user role. A chat user cannot create or edit workflows. The same paragraph says that user could still add Chat Hub tools that run code in the task runner sandbox, read and write files in the directories n8n allows, or use the workflows, Data Tables, and agents of the instance, and then run those tools through a chat. n8n's conclusion is that the user could act beyond the limits of the role.

This brief does not name the tool types, the registration call, or a chat transcript. The advisory does not either. The control that failed is the gate on who may add a tool, not a new claim about what the sandbox permits once the tool is running.

The advisories index shows more rows published on 14 October, including credential exposure in execution error data. Those rows name their own patched versions. This brief does not fold them into the Chat Hub floors.

The packages moved before the note.#

There is no report date and no vendor timeline before the packages. The impact window before 14 October is not in the advisory. What is on the registry, read tonight, is the publish clock for the three versions n8n names.

npm n8n@2.44.1 published at 07:43 UTC on 14 October. The previous 2.44 publish, 2.44.0, was 07:46 UTC on 13 October. n8n@2.43.5 published at 08:15 UTC on 14 October. The previous 2.43 publish, 2.43.4, was 07:25 UTC on 12 October. n8n@1.123.85 published at 08:28 UTC on 14 October. The previous 1.123 publish, 1.123.84, was 07:45 UTC on 8 October.

The advisory timestamp is 09:43 UTC the same morning. That is about two hours after 2.44.1 and about 75 minutes after 1.123.85, the last of the three named packages. The disclosure clock and the package clock are the same calendar day. They are not the same minute. n8n does not say when the bug was introduced, reported, or fixed in source.

The page lists affected rows as below 1.123.85, below 2.44.1, and below 2.43.5, and patched rows as those versions and later. The prose is the sentence to follow: fixed in 1.123.85, 2.43.5, and 2.44.1, upgrade to one of those or later. A later build on another line is not automatically the floor for yours. 2.43.6 is below 2.44.1 and above 2.43.5. Read it as later on the 2.43 line, which is what n8n's "or later" means there.

Tonight the registry's latest, stable, and rc tags are 2.43.6, published at 07:35 UTC on 15 October. The next and beta tags are 2.44.2, published at 07:22 UTC on 15 October. Both are later publishes than the patched version n8n names on that line. This brief did not diff them.

1. 2026-10-13
   npm publishes n8n 2.44.0 at 07:46 UTC. The Chat Hub advisory does not yet exist. n8n gives no introduced version.
2. 2026-10-14
   npm publishes 2.44.1 at 07:43 UTC, 2.43.5 at 08:15 UTC, and 1.123.85 at 08:28 UTC. CharlieKolb publishes GHSA-43v8-hjhm-chjp at 09:43 UTC. No CVE id.
3. 2026-10-15
   npm publishes 2.44.2 at 07:22 UTC and 2.43.6 at 07:35 UTC. Those are the next and latest tags tonight, later than the floors n8n named.

What to do on the line you actually run.#

Upgrade to the floor n8n names for that line, or to a later publish on it. On the 1.123 line that floor is 1.123.85. On the 2.43 line it is 2.43.5, and the latest tag tonight is 2.43.6. On the 2.44 line it is 2.44.1, and the next tag tonight is 2.44.2. If you run a line the advisory does not name, do not guess a backport. Move to one of the three floors or later.

Until that upgrade, n8n's own temporary list is the one to use. Keep the instance to users you fully trust. Do not assign the global:chatUser role to anyone you do not fully trust. Disable Chat Hub if you do not need it. Use NODES_EXCLUDE to drop high-risk node types you do not need. Set N8N_SSRF_PROTECTION_ENABLED to true to cut down outbound request abuse. n8n says these steps do not fully remediate the issue.

The sandbox is still doing the job n8n describes for code and files. The role was not. A chat user who cannot edit a workflow can still be the person who adds a tool, on any build below the floor for that line. Patch the line. Then read the other 14 October rows on the advisories index, because their versions are not this paragraph.