Local Gateway Deep-Link Connect Silently Re-pairs to Attacker-Controlled Instance
Summary
Impact
The Local Gateway desktop app could be made to connect to another n8n instance without the user's confirmation, and permissions the user had already granted carried over to that instance. An attacker who gets a user to open a crafted link could connect the user's computer to an instance t...
Affected packages
| Ecosystem | Package | Affected | Fixed |
|---|---|---|---|
| npm | n8n |
< 2.42.1 |
>= 2.42.1 |
| npm | n8n |
< 2.41.4 |
>= 2.41.4 |
Original description The description as published by the source.
Impact
The Local Gateway desktop app could be made to connect to another n8n instance without the user's confirmation, and permissions the user had already granted carried over to that instance. An attacker who gets a user to open a crafted link could connect the user's computer to an instance the attacker controls and act on it through the gateway.
The victim must have the Local Gateway app installed and running and must open a crafted link.
Patches
The issue has been fixed in n8n versions 2.42.1 and 2.41.4. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Do not open unsolicited links using the
n8n-computer-use://scheme. - Quit the Local Gateway app when it is not actively in use to reduce the window of exposure.
- Restrict the
allowedOriginssetting to the specific instance URL the Gateway is paired with, rather than relying on the default wildcard. - Disable the Computer Use / Local Gateway feature if it is not required.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Source: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
References
- GITHUB_REPO_ADVISORY n8n-io/n8n