{"id":"CVE-2026-118649","kind":"vulnerability","aliases":["CVE-2026-118649"],"related":[],"title":"n8n: crafted workflow ID lets members access every project's Data Table rows","description":"n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.","summary":"n8n caches each workflow's owner project by a client-supplied workflow ID, and an ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify and delete Data Table rows in all projects on the instance.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","data-tables","multi-project","n8n","self-hosted"],"not_affected_if":["no-workflow-create-rights","patched-version","single-project"],"how_to_check":"- Check the installed n8n version with `n8n --version` or the image tag in your deployment.\n- Confirm whether your instance has more than one project in use with Data Tables, which is where cross-project reads and writes matter.","fix":"- Upgrade n8n to `2.43.5` or later on the 2.43 line, or to `2.44.1` or later on the 2.44 line.\n- Until upgraded, restrict who can create and run workflows to trusted users.","status":"open","published_at":"2026-10-28T19:17:33+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","triaged_at":"2026-10-28T19:35:46+00:00","updated_at":"2026-10-28T19:35:46+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-28T19:35:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade n8n to `2.43.5` or later on the 2.43 line, or to `2.44.1` or later on the 2.44 line.\n- Until upgraded, restrict who can create and run workflows to trusted users.","reach":"internet","title":"n8n: crafted workflow ID lets members access every project's Data Table rows","impact":"high","summary":"n8n caches each workflow's owner project by a client-supplied workflow ID, and an ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify and delete Data Table rows in all projects on the instance.","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","data-tables","multi-project"],"confidence":0.7,"needs_auth":"yes","worst_case":"Authenticated member reads, changes or deletes Data Table rows across all projects.","analyst_note":"Confirm the exact fixed versions and the NVD entry details at https://nvd.nist.gov/vuln/detail/CVE-2026-118649; check the n8n release notes for the 2.43.5 and 2.44.1 fixes.","how_to_check":"- Check the installed n8n version with `n8n --version` or the image tag in your deployment.\n- Confirm whether your instance has more than one project in use with Data Tables, which is where cross-project reads and writes matter.","needs_analyst":true,"not_affected_if":["patched-version","single-project","no-workflow-create-rights"],"who_is_affected":"Self-hosted n8n instances before 2.43.5 or on 2.44.x before 2.44.1 are exposed. The attacker must already be an authenticated member who can create and run workflows, and the exposure is to Data Table rows held in other projects on the same instance. Instances that have not upgraded and have multiple projects holding Data Tables should treat this as in scope.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000677,"input_tokens":3356,"output_tokens":683,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-118649':16A,19A '-2026':15A,18A '2.43.5':88C '2.44':90C '2.44.1':93C 'accept':94C 'access':7A 'ai':21B 'ai-tool':20B 'authent':63B,130C 'cach':34B,102C 'check':58B,125C 'client':43B,97C 'client-suppli':42B,96C 'craft':2A,115C 'creat':67B,134C 'cve':14A,17A 'data':11A,24B,55B,77B,122C,144C 'data-t':23B 'delet':76B,143C 'everi':8A,60B,127C 'host':32B 'id':4A,46B,49B,100C,112C,116C 'instanc':85B,152C 'let':5A 'list':72B,139C 'make':53B,120C 'match':59B,126C 'member':6A,64B,131C 'memori':109C 'modifi':74B,141C 'multi':27B 'multi-project':26B 'n8n':1A,29B,33B,86C 'owner':38B,106C 'project':9A,28B,39B,57B,61B,82B,107C,124C,128C,149C 'proto':52B,119C 'read':73B,140C 'row':13A,79B,146C 'run':69B,136C 'self':31B 'self-host':30B 'suppli':44B,98C 'tabl':12A,25B,56B,78B,123C,145C 'tool':22B 'workflow':3A,36B,45B,70B,99C,104C,137C 'x':91C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted n8n instances before 2.43.5 or on 2.44.x before 2.44.1 are exposed. The attacker must already be an authenticated member who can create and run workflows, and the exposure is to Data Table rows held in other projects on the same instance. Instances that have not upgraded and have multiple projects holding Data Tables should treat this as in scope.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T19:17:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118649","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118649","severity":null,"published_at":"2026-10-28T19:17:33+00:00","modified_at":"2026-10-28T19:17:33+00:00","first_seen_at":"2026-10-28T19:34:55+00:00","fetched_at":"2026-10-28T19:34:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}