GHSA-crfj-5wv6-8v86: n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data

Published Oct 28, 2026

Updated

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.

Event History

Oct 28, 2026

CVE Published

via OSV·06:59 PM

Data Sourced

via OSV·06:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to token disclosure?

Users who can view workflow execution data are exposed if they can access failed executions for workflows using the SeaTable Trigger node, even when they do not have permission to read the underlying credential.

What conditions are required to recover the token?

A SeaTable Trigger poll request must fail and preserve error execution data containing the raw request headers. An attacker needs access to view that execution data; no credential-read permission is required.

What access could a recovered token provide?

The recovered API token can be used to access the SeaTable base connected to the affected trigger.

Which releases contain fixes?

The issue is fixed in n8n 1.123.85, 2.43.5, and 2.44.1. Affected releases are versions before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1.

GHSA-crfj-5wv6-8v86: n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data

Event History

Frequently Asked Questions

Who is exposed to token disclosure?

What conditions are required to recover the token?

What access could a recovered token provide?

Which releases contain fixes?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to token disclosure?

What conditions are required to recover the token?

What access could a recovered token provide?

Which releases contain fixes?