Improper access control in n8n - CVE-2026-54305
Published: June 16, 2026
n8n
Detailed vulnerability description
The vulnerability allows a remote user to disclose sensitive information, overwrite stored OAuth tokens, or revoke stored credential tokens.
The vulnerability exists due to improper access control in the Dynamic Credentials EE endpoints when handling requests for workflows or credentials without per-resource ownership or scope checks. A remote user can send crafted requests to enumerate credential identifiers, names, and types referenced by private workflows, overwrite another user's stored tokens with tokens bound to an account they control, or revoke stored credential tokens to disclose sensitive information, overwrite stored OAuth tokens, or revoke stored credential tokens.
Only Enterprise instances with the Dynamic Credentials feature enabled are vulnerable.