Incorrect authorization in n8n - CVE-2026-118649
Published: October 14, 2026 / Updated: November 2, 2026
Vulnerability identifier: #VU155730
CSH Severity: Low
CVSS v4: 7.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118649
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to list, read, modify and delete Data Table rows across all projects in the instance.
The vulnerability exists due to incorrect authorization in Data Table project checks when resolving workflow ownership through an in-memory cache keyed by client-supplied workflow IDs. A remote user can supply a specially crafted workflow ID that causes the cache to return an invalid owner project and the project check to match every project to list, read, modify and delete Data Table rows across all projects in the instance.
Exploitation requires permission to create and run workflows.
Affected software
n8n
How to mitigate CVE-2026-118649
Install security update from vendor's website.
n8n - addressed in versions 2.43.5, 2.44.1