CVE-2026-118647: n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.
Affected Software
Event History
Frequently Asked Questions
Who can recover the exposed SeaTable API token?
A user who can view workflow executions can recover it from error execution data, even if that user does not have permission to read the underlying credential.
What conditions are required for exposure?
The affected workflow must use a SeaTable Trigger node and experience a failed poll request. The failure causes raw request headers, including the API token, to be saved in error execution data.
What could an attacker do with a recovered token?
The recovered token can be used to access the SeaTable base connected to the trigger.
Which releases need to be updated?
Affected releases are n8n versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1.