Information Exposure Through an Error Message in n8n - #VU155723
Published: October 14, 2026
Vulnerability identifier: #VU155723
CSH Severity: Medium
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-209
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose a MongoDB database password.
The vulnerability exists due to inclusion of sensitive credential information in error data in the MongoDB Atlas Vector Store node when an operation fails. A remote user can read the stored execution error data to disclose a MongoDB database password.
Exploitation requires permission to view the workflow's executions, but does not require permission to read the credential.
Affected software
n8n
Remediation
Install security update from vendor's website.
n8n - addressed in versions 1.123.85, 2.43.5, 2.44.1