p PatchFirst

CVE-2026-118675

CVE-2026-118675 · n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow

This page contains facts from public vulnerability sources. Check the original advisory before updating.

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values.

CVSS 5.1 · Medium · EPSS 0.2% · Fix available

Published
Updated

Affected products and versions

  • n8n

    Versions
    • ≥ 0, < 1.123.85: Affected (semver)
    • 1.123.85: Not affected (semver)

    Update to 1.123.85

  • n8n

    Versions
    • ≥ 2.44.0, < 2.44.1: Affected (semver)
    • 2.44.1: Not affected (semver)

    Update to 2.44.1

  • n8n

    Versions
    • ≥ 2.0.0, < 2.43.5: Affected (semver)
    • 2.43.5: Not affected (semver)

    Update to 2.43.5

Original sources

Check your server →