| Component | n8n |
| Severity | medium (CVSS 6.5) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| Published (NVD) | 2026-09-03 |
| Last modified | 2026-09-16 |
| Affected versions | n8n < 1.123.73 n8n >= 2.0.0, < 2.35.4 n8n >= 2.36.0, < 2.36.2 |
| Fixed in | 1.123.73, 2.35.4, 2.36.2 |
| Weakness | CWE-532 |
| CISA KEV | not listed |
NVD description
n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.
What to do
- Upgrade n8n to
1.123.73or later (or the patched release of your branch: 2.35.4, 2.36.2). - Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-85171
- https://github.com/n8n-io/n8n/security/advisories/GHSA-vrv8-j27g-g7cr
- https://www.vulncheck.com/advisories/n8n-before-1.123.73-credential-exposure-via-error-logging
Read more
Other n8n CVEs
n8n versions before 1.123.80 contain a credential tampering vulnerability where duplicate node IDs bypass the workflow credential tamper gua...
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a stored DOM cross-site scripting vulnerabilit...
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in the Supabase...
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 fail to validate credential ownership during inline agent node-tool introspection. Attac...
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a filter injection vulnerability in the Supaba...
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a NoSQL injection vulnerability in the MongoDB...