Information Exposure Through an Error Message in n8n - #VU155724
Published: October 14, 2026
Vulnerability identifier: #VU155724
CSH Severity: Medium
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-209
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose a Google access token.
The vulnerability exists due to inclusion of sensitive credential information in error data in the Google Cloud Storage node when an operation fails. A remote user can read the stored execution error data to disclose a Google access token.
Exploitation requires permission to view the workflow's executions, but does not require permission to read the credential.
Affected software
n8n
Remediation
Install security update from vendor's website.
n8n - addressed in versions 1.123.85, 2.43.5, 2.44.1