Live › vulnerability › CVE-2026-118649
Go to dashboardn8n caches each workflow's owner project by a client-supplied workflow ID, and an ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify and delete Data Table rows in all projects on the instance.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Self-hosted n8n instances before 2.43.5 or on 2.44.x before 2.44.1 are exposed. The attacker must already be an authenticated member who can create and run workflows, and the exposure is to Data Table rows held in other projects on the same instance. Instances that have not upgraded and have multiple projects holding Data Tables should treat this as in scope.
No product ranges from the sources yet.
n8n --version or the image tag in your deployment.2.43.5 or later on the 2.43 line, or to 2.44.1 or later on the 2.44 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as proto makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.
This page as .md · .json · in your agent: get_signal("CVE-2026-118649")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.