CVE-2026-118644: n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance
n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.41.5 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.42.2
Event History
Frequently Asked Questions
Who can exploit this issue?
A project editor can exploit it by changing a colleague's workflow error-workflow setting to point to an error workflow the editor owns. Exploitation also requires the colleague's workflow to fail so its execution context is passed to that error workflow.
What credentials can be exposed?
The issue can expose per-user dynamic credential secrets associated with the user who started the failed workflow. The attacker inherits that user's identity in the configured error workflow and can resolve those secrets.
Are all n8n deployments affected by default?
The provided information identifies the affected versions but does not state that the vulnerable path is enabled by default. Exposure depends on project-editor access, the ability to configure another user's error workflow, and a failed workflow execution.
Which versions should be remediated?
Upgrade to n8n 2.41.5 or later in the 2.41 line, or 2.42.2 or later in the 2.42 line. Versions before 2.41.5 and 2.42.x before 2.42.2 are affected.