{"schema":"threatline.record/2","record":{"id":"GHSA-crfj-5wv6-8v86","aliases":["GHSA-crfj-5wv6-8v86"],"summary":"SeaTable Trigger Node Stores the API Token in Failed Poll Execution Data","details":"## Impact\n\nThe SeaTable Trigger node requests a base access token with the credential's API token in an Authorization header. When that request failed during polling, the raw HTTP error, including the request headers, was saved in the error execution. A user who can view the workflow's executions, but cannot read the credential, can recover the API token and use it against the connected SeaTable base.\n\n## Patches\n\nThe issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Deactivate SeaTable poll-trigger workflows until the instance is patched.\n- Rotate any SeaTable API tokens used by poll-trigger workflows and audit recent execution records for unexpected token exposure.\n- Restrict execution read access to the minimum set of users who require it.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-crfj-5wv6-8v86","source_modified_at":"2026-10-14T09:44:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 1.123.85"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-crfj-5wv6-8v86","source_modified_at":"2026-10-14T09:44:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.44.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-crfj-5wv6-8v86","source_modified_at":"2026-10-14T09:44:00Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.43.5"}],"fixed_versions":[],"cvss":5.3,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-14T09:44:00Z","modified_at":"2026-10-14T09:44:00Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-crfj-5wv6-8v86","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T09:44:00Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T09:44:00Z","content_hash":"2417a7f2a2f409e22c42710b74da039e8d29dd13a462ea0458d0849882e8fddd"}}