All vulnerabilities
CVE-2026-118644GHSA-pcr3-v5vr-qppf

n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance

n8n-io n8nFrameworks
Open in ThreatlineRecord JSON
CVSS
5.1Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in2.42.2Also 2.41.5CVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.

Text from CVE List

Affected versions 4

  • n8naffected: 2.42.0 before 2.42.2CVE List
  • n8nunaffected: 2.42.2CVE List
  • n8naffected: all versions before 2.41.5CVE List
  • n8nunaffected: 2.41.5CVE List

References 2