Live › vulnerability › CVE-2026-118643
Go to dashboardn8n stores credential secrets such as Git passwords and tokens, MongoDB database passwords, and Google access tokens inside execution error data when those nodes fail. A user who can view workflow executions but cannot read the credential can recover those secrets from the stored error data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Self-hosted or cloud n8n instances on versions before the fixed releases that run workflows using the Git, MongoDB Atlas Vector Store or Google Cloud Storage nodes. Exposure requires that some users can view executions without holding access to the underlying credentials. Instances with only one trusted admin or without these nodes are less exposed.
No product ranges from the sources yet.
n8n --version and compare against the fixed versions below.1.123.85 or later.2.43.5 or later, and 2.44.x to 2.44.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data.
This page as .md · .json · in your agent: get_signal("CVE-2026-118643")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.