Cross-User Credential Access in n8n Workflow Automation Platform

CVE-2026-54307

What is CVE-2026-54307?

n8n, an open-source workflow automation platform, has a vulnerability that allows users with editor access to shared workflows to improperly reference credentials belonging to other users. This vulnerability arises from insufficient checks in credential ownership enforcement, particularly when workflow sharing is enabled. It impacts configurations where workflows have been shared with editor-level members, potentially exposing sensitive information. The issue has been addressed in versions 1.123.55, 2.25.7, and 2.26.2, ensuring enhanced protection against unauthorized credential access.

References