CVE-2026-54307: n8n: Credential Exfiltration via Permission Bypass
Impact A member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential ownership checks were only enforced partially leading to cross-user credential access.
This issue affects instances where workflow sharing is enabled and at least one workflow has been shared with a member-level user as an Editor.
Patches The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow sharing to fully trusted users only. - Audit shared workflows for unexpected credential references or recent modifications.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Credits: Momen Elkhouli
Other sources
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential ownership checks were only enforced partially leading to cross-user credential access. This issue affects instances where workflow sharing is enabled and at least one workflow has been shared with a member-level user as an Editor. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.25.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.26.2 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.55 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.55 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.25.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.26.2 - Configuration
Restrict workflow sharing so it is limited to fully trusted users only.
n8n workflow sharing shared workflow access level = fully trusted users only - Compensating control
Audit shared workflows for unexpected credential references or recent modifications.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54307?
The severity of CVE-2026-54307 is critical with a CVSS score of 9.6.
How do I fix CVE-2026-54307?
To fix CVE-2026-54307, ensure that credential ownership checks are fully enforced in your workflow configuration.
What impact does CVE-2026-54307 have on user data?
CVE-2026-54307 allows a member-level user with editor access to reference credentials they do not own, leading to potential unauthorized access to sensitive information.
What software is affected by CVE-2026-54307?
CVE-2026-54307 affects the npm/n8n workflow automation software.
When was CVE-2026-54307 published?
CVE-2026-54307 was published on June 16, 2026.