n8nPublished 28 Oct 2026NVD status: Deferred

CVE-2026-118642

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values.

Componentn8n
Severityhigh (CVSS 7.1)
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Published (NVD)2026-10-28
Affected versions
< 1.123.85
>= 2.0.0, < 2.43.5
>= 2.44.0, < 2.44.1
from the CVE Program record written by the CNA that assigned the CVE
Fixed in1.123.85, 2.43.5, 2.44.1
WeaknessCWE-863
CISA KEVnot listed

Versions, checked against NVD

NVD's record (status: Deferred) lists no affected versions of n8n for this CVE. The ranges above come from the CVE record written by VulnCheck, the CNA that assigned the CVE.

NVD description

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.

What to do

  • Upgrade n8n to the fixed release of the branch you run: 1.123.85, 2.43.5 or 2.44.1, or later.
  • Do not expose the component's API or UI to the internet without authentication in front of it.

Sources

Read more