{"schema":"threatline.record/2","record":{"id":"GHSA-pcr3-v5vr-qppf","aliases":["GHSA-pcr3-v5vr-qppf"],"summary":"Per-User Credential Theft via Error-Workflow Execution Context Inheritance","details":"## Impact\n\nWhen a workflow fails, n8n runs the workflow named in its error-workflow setting and hands it the failed run's execution context, including the carrier that binds the run to the user who started it. A project editor could point a colleague's workflow at an error workflow they own, inherit the colleague's identity in their own execution, and resolve that user's per-user credential secrets. The error workflow now receives only non-identity fields.\n\n## Patches\n\nThe issue has been fixed in n8n versions 2.42.2 and 2.41.5. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Audit team project memberships and remove editor access from any users who are not fully trusted.\n- Review all active workflows and audit the `settings.errorWorkflow` field for unexpected values.\n- Disable the dynamic credentials feature if it is not required.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pcr3-v5vr-qppf","source_modified_at":"2026-10-14T09:43:37Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.42.2"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pcr3-v5vr-qppf","source_modified_at":"2026-10-14T09:43:37Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.41.5"}],"fixed_versions":[],"cvss":5.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-14T09:43:37Z","modified_at":"2026-10-14T09:43:37Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pcr3-v5vr-qppf","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T09:43:37Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T09:43:37Z","content_hash":"f94826485f736a8c303bc3e6f55ce435dd38095fd0238a9b209e0e4186a7fe62"}}