N8N · GHSA-v9cx-v88r-42vw · AI agents & MCP
FIX → >= 1.123.85 +2
n8n checks that a workflow's owner may use each credential it references, but the check misses credential slots whose default values are not stored, so a member can run a workflow that uses a credential they cannot access. The decrypted credential can then be sent to a destination the member chooses.
first public Oct 14, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Teams that run a self-hosted n8n instance with more than one member account, where members can create or run workflows that reference credentials. Instances where only fully trusted users have access are less exposed, as the advisory's workarounds suggest. The advisory does not describe exposure through managed hosting.
Not affected if single-user-instance, trusted-users-only
Who cares credentials, n8n, self-hosted, workflows
npm ls n8n or the n8n version in the instance settings.Before a workflow runs, n8n checks that its owner may use every credential the workflow references. That check only looked at credential slots it considered active, and it decided which slots were active from the parameters as stored, where default values are omitted. At execution the defaults are restored and the node uses the credential. A member can therefore save and run a workflow that references a credential they have no access to, and have its decrypted value sent to a destination they choose.
The issue has been fixed in n8n versions 1.123.85, 2.43.5, and 2.44.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to >= 1.123.85 +2
1.123.85 or later.2.43.5 or later.2.44.1 or later.