---
id: "GHSA-crfj-5wv6-8v86"
page: "https://infrastack.ai/live/GHSA-crfj-5wv6-8v86"
kind: "vulnerability"
aliases: ["GHSA-crfj-5wv6-8v86"]
title: "SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "n8n", "fixed": [">= 1.123.85"], "affected": "< 1.123.85", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.44.1"], "affected": "< 2.44.1", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.43.5"], "affected": "< 2.43.5", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "n8n", "seatable", "self-hosted"]
not_affected_if: ["managed-hosting-patched", "no-seatable-trigger"]
published_at: "2026-10-14T09:44:00+00:00"
first_seen_at: "2026-11-09T22:53:26+00:00"
updated_at: "2026-11-09T22:56:49+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-crfj-5wv6-8v86", "first_seen_at": "2026-11-09T22:53:26+00:00"}]
exploit_sources: []
---

# SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data

Link for people: https://infrastack.ai/live/GHSA-crfj-5wv6-8v86 (this .md is for agents)

The SeaTable Trigger node in n8n puts the credential's API token in an Authorization header, and a failed poll saves the raw HTTP error with those headers into execution data. A user who can view executions but cannot read the credential can recover the token and use it against the connected SeaTable base.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:n8n affected < 1.123.85 fixed >= 1.123.85
- npm:n8n affected < 2.44.1 fixed >= 2.44.1
- npm:n8n affected < 2.43.5 fixed >= 2.43.5

## How to check

- Check the installed n8n version with `n8n --version` or the `n8n` entry in `package.json`, and compare it to the fixed versions.
- Look for workflows that use the SeaTable Trigger node and review their failed execution records for stored request headers.

## Fix

- n8n `1.123.85`
- n8n `2.43.5`
- n8n `2.44.1`

## Timeline

- 2026-11-09T22:53:26+00:00 ghsa-repo https://github.com/n8n-io/n8n/security/advisories/GHSA-crfj-5wv6-8v86

## Documents

- [advisory] Vendor advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-crfj-5wv6-8v86

## From the sources

## Impact

The SeaTable Trigger node requests a base access token with the credential's API token in an Authorization header. When that request failed during polling, the raw HTTP error, including the request headers, was saved in the error execution. A user who can view the workflow's executions, but cannot read the credential, can recover the API token and use it against the connected SeaTable base.

## Patches

The issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Deactivate SeaTable poll-trigger workflows until the instance is patched.
- Rotate any SeaTable API tokens used by poll-trigger workflows and audit recent execution records for unexpected token exposure.
- Restrict execution read access to the minimum set of users who require it.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_