Live › vulnerability › CVE-2026-118647
Go to dashboardn8n stores the SeaTable Trigger node's API token in error execution data, because failed poll requests save raw request headers. A user who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Self-hosted or cloud n8n instances that run workflows with the SeaTable Trigger node. Exposure needs a user who can view workflow executions but cannot read the SeaTable credential. Instances with no SeaTable Trigger workflows, or where only trusted admins see executions, have less exposure.
No product ranges from the sources yet.
n8n --version (or check the image tag) and compare against 1.123.85, 2.43.5 and 2.44.1.1.123.85 or later.2.43.5 or later, and 2.44.x to 2.44.1 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.
This page as .md · .json · in your agent: get_signal("CVE-2026-118647")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.