Live › vulnerability › CVE-2026-118642
Go to dashboardn8n before 1.123.85, 2.43.5, and 2.44.1 has an authorization bypass in inline sub-workflow nodes that skip the credential permission check when the disabled value is non-boolean. An authenticated member who knows a credential id can run an Execute Workflow node in inline JSON mode and send the decrypted credential to a server they control.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Self-hosted or cloud n8n instances on the affected versions with more than one authenticated member who can create or edit workflows. An attacker needs a credential id and a member account; instances with a single trusted user or no multi-user workflow editing are less exposed.
No product ranges from the sources yet.
n8n --version or the image tag, and compare against 1.123.85, 2.43.5, and 2.44.1.1.123.85 on the 1.x line, 2.43.5 on the 2.43 line, or 2.44.1 on the 2.44 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.
This page as .md · .json · in your agent: get_signal("CVE-2026-118642")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.