CVE-2026-85171 in n8n
Summary
by MITRE • 09/03/2026
n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in n8n versions prior to 1.123.73, 2.35.4, and 2.36.2 represents a critical failure in credential management within specific workflow nodes including Strapi, SeaTable, and Mailcheck. This flaw stems from the architectural decision to utilize a raw legacy HTTP helper for transmitting authentication data to external service endpoints. Unlike modern implementations that employ secure wrappers or encrypted channels, this legacy approach bypasses standard security controls during the request lifecycle. Specifically, when an error occurs during the execution of these nodes, the system fails to catch and handle the exception properly before logging or storing execution details. Consequently, the decrypted credentials are included in the raw HTTP response data captured by the framework's debugging and execution tracking mechanisms. This results in the plaintext secret being persisted within the execution error logs, which are accessible via the application interface.
From a technical perspective, this issue is classified under CWE-798: Use of Hard-coded Credentials or CWE-200: Exposure of Sensitive Information to an Unauthorized Actor, depending on whether the credentials were hardcoded in the workflow definition or fetched from secure storage at runtime. In either case, the exposure occurs because the error handling logic does not sanitize sensitive fields before persisting them. The vulnerability is particularly severe because it affects authenticated users who can interact with their own workflows. By triggering an execution that results in a failure within one of the affected nodes, an attacker or malicious insider can retrieve the full plaintext credentials from the returned error object through the REST API. This bypasses the blank-value redaction logic typically enforced by the dedicated credentials API endpoint, which is designed to mask sensitive data during normal operations and standard API responses.
The operational impact of this vulnerability allows any authenticated user with access to workflow execution history or logs to extract secrets belonging to other users if they can manipulate shared workflows or if the system does not strictly isolate execution contexts per tenant in multi-tenant deployments. Even in single-user instances, it poses a significant risk as compromised credentials for services like Strapi, SeaTable, and Mailcheck could lead to unauthorized access, data exfiltration, or further lateral movement within connected systems. The ability to read plaintext secrets through the REST API means that automated tools can easily scrape these values without requiring complex exploitation techniques beyond triggering specific error conditions in workflow executions. This undermines the fundamental security principle of least privilege and confidentiality for stored credentials.
To mitigate this risk, organizations running affected versions must upgrade immediately to n8n version 1.123.73, 2.35.4, or later where the issue has been resolved by implementing proper error handling that excludes sensitive data from execution logs. Until an upgrade is possible, administrators should rotate all credentials associated with Strapi, SeaTable, and Mailcheck nodes to invalidate any potentially exposed secrets. Additionally, reviewing access controls for workflow execution history and REST API endpoints can help limit exposure if the vulnerability cannot be patched immediately. Security teams should also audit existing workflows for similar patterns of using legacy HTTP helpers without adequate error handling safeguards to prevent recurrence in other parts of their automation infrastructure. This incident highlights the importance of rigorous code review practices regarding credential handling, particularly when integrating with external services via API calls that may fail and generate verbose logs.