Live › vulnerability › CVE-2026-118676
Go to dashboardn8n workflows can be saved so that pre-execution checks skip credential slots when default node parameters are omitted. A member user can thereby have decrypted credential values sent to destinations the attacker chooses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 19:34 UTC. All times on this page are UTC.
Self-hosted or cloud n8n instances where non-admin member users can create and execute workflows that use stored credentials. Instances where only trusted administrators can build workflows have a smaller exposure, but the fix is still the version upgrade.
No product ranges from the sources yet.
n8n --version or the n8n package version in package.json; versions below 1.123.85, 2.43.5 or 2.44.1 on their respective release lines are in scope.1.123.85 on the 1.x line, 2.43.5 on the 2.43 line, or 2.44.1 on the 2.44 line.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-execution checks skip credential slots, causing decrypted credential values to be sent to attacker-chosen destinations.
This page as .md · .json · in your agent: get_signal("CVE-2026-118676")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.