CVE-2026-110850 in n8n
Summary
by MITRE • 10/15/2026
n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to resolve the owner's credentials and send decrypted secrets to an attacker-chosen destination.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in n8n versions prior to 2.41.4 and within the specific range of version 2.42.0 up to but not including 2.42.1 represents a critical authentication bypass and credential exposure flaw rooted in insufficient input validation during workflow serialization processes. This issue specifically affects the handling of shared workflows when an editor modifies and saves them, exposing users who share their automation logic with others to severe security risks. The core technical deficiency lies within the agent node implementation, particularly concerning how credentials are resolved and validated against stored identifiers. When a user shares a workflow, they grant collaborators the ability to edit its configuration. If an editor configures a Message an Agent node in inline mode using tools that they control or have injected into the system, the application fails to perform adequate verification of the credential IDs associated with those tools before execution.
The operational mechanism of this flaw exploits the discrepancy between how credentials are stored and how they are validated during the save operation. The validation logic inspects only the node's direct credentials field but neglects to verify that any tool configurations embedded within the agent parameters actually belong to or are authorized by the workflow owner. This oversight allows a malicious editor to substitute legitimate credential references with identifiers pointing to tools under their own control. Consequently, when the workflow is executed, the system resolves these manipulated references using the original owner's high-privilege credentials rather than restricting access to only those explicitly intended for the tool being used. This effectively bypasses authorization controls designed to isolate user permissions and protect sensitive authentication data from unauthorized parties within a shared workspace environment.
The impact of this vulnerability is severe, leading directly to the exfiltration of decrypted secrets and private API keys belonging to the workflow owner. An attacker who has edit access to a shared workflow can leverage this flaw to configure the agent node such that it processes requests using the victim's credentials but routes the resulting data or sensitive outputs to an external destination controlled by the attacker. This constitutes a significant breach of confidentiality, as internal secrets, database connection strings, and other authentication tokens are transmitted outside the organization's perimeter without detection. The risk is amplified in enterprise environments where workflows often integrate with critical backend systems, meaning that compromising one shared workflow can serve as a pivot point for broader network compromise or data theft across multiple integrated services.
From a classification perspective, this vulnerability aligns closely with CWE-284 Improper Access Control and CWE-798 Use of Hard-coded Credentials if the resolved credentials are treated as static secrets within the execution context. It also maps to MITRE ATT&CK techniques related to Credential Dumping and Exfiltration Over C2 Channels, specifically illustrating how legitimate application functionality can be abused for unauthorized data access and transfer. The failure to validate resource ownership during shared workflow operations highlights a gap in identity verification logic that is critical for multi-tenant or collaborative automation platforms where trust boundaries between users must be strictly enforced even within editable artifacts.
Mitigation strategies require immediate updates to the n8n platform, with organizations advised to upgrade to version 2.41.4 and later, as well as version 2.42.1 and subsequent releases which address this validation deficiency. In addition to patching, administrators should enforce strict role-based access controls on shared workflows, limiting edit permissions only to trusted individuals who require such privileges for operational purposes. Implementing workflow approval processes before execution can also provide an additional layer of security by ensuring that any changes made by editors are reviewed and validated by the original owner or a designated security officer. Furthermore, auditing logs for unusual credential resolution patterns or unexpected outbound data transfers from agent nodes can help detect potential exploitation attempts in environments where immediate patching is not feasible due to operational constraints.