CVE-2026-118642
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows…
- Risk score
- 43/100
- CVSS
- 7.1 v3.1
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.123.85, 2.43.5 or 2.44.1 (whichever matches your release line), or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.1 high
References
Original description
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.
Last activity 28 Oct 2026. Patch Forecast updates every hour.