Credential Exposure in n8n Workflow Automation Platform

CVE-2026-118643

What is CVE-2026-118643?

Certain versions of the n8n workflow automation platform exhibit a vulnerability where credential secrets are stored within execution error data if operations fail in specific nodes. This includes Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users capable of viewing workflow executions, but not authorized to read the credentials, may potentially retrieve sensitive information such as Git passwords or tokens, MongoDB database passwords, or Google access tokens. This vulnerability poses significant security risks, necessitating prompt updates to affected versions.

References