CVE-2026-118644

CVE-2026-118644 · n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.

CVSS 5.1 · Moyenne · EPSS 0,2% · Correctif disponible

Publication: 2026-10-28T18:59:44.266Z
Mise à jour: 2026-10-28T18:59:44.266Z

Produits et versions concernés

n8n
Versions du logiciel
- ≥ 2.42.0, < 2.42.2: Concernée (semver)
- 2.42.2: Non concernée (semver)
Mettez à jour vers 2.42.2
n8n
Versions du logiciel
- ≥ 0, < 2.41.5: Concernée (semver)
- 2.41.5: Non concernée (semver)
Mettez à jour vers 2.41.5

Sources originales

Vérifiez votre serveur →