CVE-2026-118676 in n8n
Summary
by MITRE • 10/28/2026
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-execution checks skip credential slots, causing decrypted credential values to be sent to attacker-chosen destinations.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The identified security flaw resides within the n8n workflow automation platform prior to versions 1.123.85, 2.43.5, and 2.44.1, representing a critical authorization bypass vulnerability that undermines the fundamental principle of least privilege. This issue specifically affects member users who lack explicit permissions for certain credential stores or specific credentials within those stores. The core technical deficiency lies in how the application handles parameter validation during workflow execution. When constructing workflows, n8n relies on default node parameters to establish a baseline configuration and perform security checks before allowing data processing. However, attackers can exploit this mechanism by deliberately omitting these default parameters when defining nodes that require authentication. By stripping away the standard parameter structure, the attacker effectively bypasses the pre-execution validation logic designed to verify user access rights for specific credentials.
From an operational perspective, this vulnerability allows unauthorized users to save and execute workflows containing sensitive credential slots without triggering the expected permission errors. The system fails to adequately validate whether the current user has read or use permissions for the referenced credentials before proceeding with execution. Consequently, when the workflow runs, n8n decrypts the stored credential values using its internal encryption mechanisms and transmits these plaintext secrets to destinations chosen by the attacker. This results in a severe data exposure incident where sensitive authentication tokens, API keys, database passwords, or other proprietary access details are exfiltrated from the secure vault directly into external systems controlled by malicious actors. The impact is compounded by the fact that this occurs during automated workflow execution, meaning the breach can happen repeatedly and silently without immediate user intervention or alerting mechanisms detecting the unauthorized data transfer.
This vulnerability aligns with CWE-269, which describes Improper Control of Interaction with User, as it involves a failure to properly enforce access controls on resources based on user roles. Furthermore, in the context of the MITRE ATT&CK framework, this behavior is consistent with techniques related to Credential Access and Defense Evasion, specifically how attackers manipulate application logic to bypass security checks and harvest credentials for lateral movement or further exploitation. The ability to decrypt and send secrets indicates a failure in both authorization enforcement at the API level and potentially insufficient sanitization of input parameters that dictate resource access paths.
To mitigate this risk, organizations running n8n must immediately upgrade to version 1.123.85, 2.43.5, or later versions where these validation checks have been hardened. Until an update is applied, administrators should restrict workflow execution permissions strictly and audit existing workflows for any nodes that might be susceptible to parameter omission attacks. It is also advisable to rotate all credentials stored within the n8n instance as a precautionary measure, assuming they may have already been compromised if the vulnerability was actively exploited in production environments. Long-term remediation strategies should include implementing stricter input validation layers and ensuring that pre-execution checks are robust against edge cases involving missing or null parameters.