Incorrect authorization in n8n - CVE-2026-118676
Published: November 9, 2026 / Updated: November 10, 2026
Vulnerability identifier: #VU163082
CSH Severity: Low
CVSS v4: 6 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118676
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an authenticated attacker with member privileges to steal credentials they are not authorized to access.
The vulnerability exists due to n8n's credential permission check evaluating stored node parameters without omitted defaults, which are restored during execution. An authenticated attacker with member privileges can save and run a workflow with omitted default parameters to send an unauthorized credential's decrypted value to a destination they control.
Affected software
n8n
How to mitigate CVE-2026-118676
Install security update from vendor's website.
n8n - addressed in versions 1.123.85, 2.43.5, 2.44.1