Error Workflow Context Vulnerability in n8n by n8n Inc.
CVE-2026-118644

5.1MEDIUM

Key Information:

Vendor

N8n-io

Status
N8n
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118644?

n8n versions before 2.41.5 and 2.42.x up to 2.42.1 expose a critical flaw where the complete execution context of a failed workflow, including user identity details, is passed to the configured error workflow. This allows a project editor to manipulate a colleague's workflow settings and gain unauthorized access to their dynamic credential secrets upon workflow failure. The vulnerability poses a significant risk when workflows are improperly handled, as it enables credential theft through context inheritance.

Affected Version(s)

n8n 2.42.0 < 2.42.2

n8n 0 < 2.41.5

n8n 2.42.2

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-pc...
vendor-advisory
https://www.vulncheck.com/advisories/n8n-before-2.41.5-an...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

sm1ee
.