| Component | n8n |
| Severity | high (CVSS 8.2) |
| CVSS vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N |
| Published (NVD) | 2026-10-28 |
| Affected versions | < 1.123.85 < 2.43.5 >= 2.44.0, < 2.44.1 read from the advisory text, followed where the structured sources say otherwise |
| Fixed in | 2.43.5, 2.44.1 |
| Weakness | CWE-532 |
| CISA KEV | not listed |
Versions, checked against NVD
NVD's record (status: Deferred) lists no affected versions of n8n for this CVE. The ranges above are read from the advisory text: neither a GitHub-reviewed advisory nor the CVE record confirms them yet.
NVD description
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.
What to do
- Upgrade n8n to the fixed release of the branch you run:
2.43.5or2.44.1, or later. - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-118647
- https://github.com/n8n-io/n8n/security/advisories/GHSA-crfj-5wv6-8v86
- https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-seatable-trigger-api-token-exposure-via-execution-data