CVE-2026-118649: n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables
n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as proto makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated n8n member who can create and run workflows can exploit it. No user interaction is required.
What data and actions are exposed if exploitation succeeds?
The attacker can list, read, modify, and delete Data Table rows across all projects in the same n8n instance.
Which versions need remediation?
Versions before 2.43.5 are affected, as are 2.44.x versions before 2.44.1. Upgrade to 2.43.5 or 2.44.1 or later.
Is a specially configured Data Table required?
The issue affects the instance-wide project authorization check for Data Tables. A member with workflow creation and execution permissions can target Data Table rows in every project.