Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-118644

n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n-io n8n

Default version status: unaffected

  • 2.42.0 to < 2.42.2affected
  • 2.42.2unaffected
pkg:npm/n8n

n8n-io n8n

Default version status: unaffected

  • 0 to < 2.41.5affected
  • 2.41.5unaffected
pkg:npm/n8n

References