Live › vulnerability › CVE-2026-118644
Go to dashboardn8n passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can point a colleague's workflow at an error workflow they own and then resolve the colleague's per-user dynamic credential secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Self-hosted or cloud n8n instances on the affected versions where more than one user shares a project and project editors can change workflow settings. Instances with a single user or with no per-user dynamic credentials have less exposure. unknown whether further conditions apply.
No product ranges from the sources yet.
n8n --version; affected builds are before 2.41.5 and 2.42.x before 2.42.2errorWorkflow values pointing to workflows owned by other users2.41.5 or later on the 2.41 line, or to 2.42.2 or later on the 2.42 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.
This page as .md · .json · in your agent: get_signal("CVE-2026-118644")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.