CVE-2026-85171: n8n before 1.123.73 Credential Exposure via Error Logging
n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.
Affected Software
Event History
Frequently Asked Questions
Which users can retrieve exposed credentials?
Any authenticated user can read the plaintext secret from their own execution through the REST API. The issue bypasses the blank-value redaction normally applied by the credentials API.
What must occur for a credential to be recorded in execution error data?
A Strapi, SeaTable, or Mailcheck node must send decrypted credentials to its authentication endpoint using the raw legacy HTTP helper, and the resulting failure must be stored as execution error data. The plaintext secret is then persisted in that error data.
Which releases are affected?
Affected releases are n8n versions before 1.123.73, 2.35.4, and 2.36.2.