CVE-2026-118676: n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use credentials they cannot access by omitting default node parameters. Attackers can save and run workflows where pre-execution checks skip credential slots, causing decrypted credential values to be sent to attacker-chosen destinations.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Member users are the relevant threat model. They must be able to save and run workflows, but do not need permission to access the credential they target.
What does exploitation require?
An attacker must craft a workflow that omits default node parameters so that pre-execution checks skip credential slots. They can then run the workflow and cause decrypted credential values to be sent to destinations they choose.
Are credentials exposed only if they are directly accessible to the attacker?
No. The bypass specifically permits member users to use credentials they cannot access through normal authorization checks.
Which versions need to be remediated?
Versions before 1.123.85, 2.43.5, and 2.44.1 are affected. Upgrade to the applicable fixed version or later.