Skip to content
CVE PROGRAM SOURCE RECORD5.1 Medium

CVE-2026-118675

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n-io n8n

Default version status: unaffected

  • 0 to < 1.123.85affected
  • 1.123.85unaffected
pkg:npm/n8n

n8n-io n8n

Default version status: unaffected

  • 2.44.0 to < 2.44.1affected
  • 2.44.1unaffected
pkg:npm/n8n

n8n-io n8n

Default version status: unaffected

  • 2.0.0 to < 2.43.5affected
  • 2.43.5unaffected
pkg:npm/n8n

References