API Token Exposure in n8n's SeaTable Trigger Node

CVE-2026-118647

What is CVE-2026-118647?

The n8n platform, specifically its SeaTable Trigger node, contains a vulnerability where the API token is stored in error execution data due to failed poll requests saving raw request headers. This flaw allows users who can view workflow executions, without having access to read the credential, to retrieve the token and gain unauthorized access to the associated SeaTable base. This issue has been identified in versions prior to 1.123.85, 2.43.5, and 2.44.1.

References