Inclusion of Sensitive Information in Log Files in n8n - CVE-2026-118647
Published: October 14, 2026 / Updated: November 2, 2026
Vulnerability identifier: #VU155728
CSH Severity: Medium
CVSS v4: 7.6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118647
CWE-ID: CWE-532
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to disclose the SeaTable API token and access the connected SeaTable base.
The vulnerability exists due to storage of sensitive information in error execution records in the SeaTable Trigger node when a polling request for a base access token fails. A remote user can read the saved HTTP error, including the Authorization header, to disclose the SeaTable API token and access the connected SeaTable base.
Exploitation requires permission to view the workflow's executions, but does not require permission to read its credential.
Affected software
n8n
How to mitigate CVE-2026-118647
Install security update from vendor's website.
n8n - addressed in versions 1.123.85, 2.43.5, 2.44.1