Credential Check Bypass in n8n by n8n-io

CVE-2026-110850

What is CVE-2026-110850?

The n8n automation tool prior to version 2.41.4 and between versions 2.42.0 and 2.42.1 is vulnerable due to insufficient validation of credential IDs stored in agent node parameters. When an editor saves a shared workflow, the system only inspects a node's credentials field, allowing malicious editors to manipulate a Message an Agent node in inline mode. This exploitation could result in the unauthorized resolution of the owner's credentials, leading to sensitive secrets being transmitted to a destination chosen by the attacker.

References