---
id: "CVE-2026-118643"
kind: "vulnerability"
aliases: ["CVE-2026-118643"]
title: "n8n: failed Git, MongoDB and GCS nodes leak credential secrets in execution data"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "ai-workflows", "credentials", "n8n", "self-hosted"]
not_affected_if: ["no-git-mongodb-gcs-nodes", "patched-version", "single-trusted-user"]
published_at: "2026-10-28T19:17:32+00:00"
first_seen_at: "2026-10-28T19:34:55+00:00"
updated_at: "2026-10-28T19:35:56+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118643", "first_seen_at": "2026-10-28T19:34:55+00:00"}]
---

# n8n: failed Git, MongoDB and GCS nodes leak credential secrets in execution data

n8n stores credential secrets such as Git passwords and tokens, MongoDB database passwords, and Google access tokens inside execution error data when those nodes fail. A user who can view workflow executions but cannot read the credential can recover those secrets from the stored error data.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `n8n --version` and compare against the fixed versions below.
- Check whether any workflow uses the Git, MongoDB Atlas Vector Store or Google Cloud Storage nodes.
- Review which users can view executions in the n8n UI and whether they lack access to the credentials those workflows use.

## Fix

- Upgrade n8n 1.x to `1.123.85` or later.
- Upgrade n8n 2.x to `2.43.5` or later, and 2.44.x to `2.44.1` or later.
- Rotate Git tokens, MongoDB database passwords and Google access tokens used by affected workflows if executions were visible to unauthorized users.

## Timeline

- 2026-10-28T19:34:55+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118643

## From the sources

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_