GHSA-wvjj-qg37-pv73: n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

Published Oct 28, 2026

Updated

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as proto makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.

Event History

Oct 28, 2026

CVE Published

via OSV·06:59 PM

Data Sourced

via OSV·06:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users can exploit this issue?

Any authenticated n8n member who is allowed to create and run workflows can exploit it. The attacker does not need access to the target projects whose Data Table rows they access.

What data and actions are exposed if exploitation succeeds?

An attacker can list, read, modify, and delete Data Table rows across all projects in the affected n8n instance. The impact is limited to Data Table rows as described.

Does exploitation require user interaction or a complex attack path?

No user interaction is required. The attacker supplies a crafted workflow ID, such as __proto__, when creating or running a workflow, causing the Data Table project check to match every project.

GHSA-wvjj-qg37-pv73: n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

Event History

Frequently Asked Questions

Which users can exploit this issue?

What data and actions are exposed if exploitation succeeds?

Does exploitation require user interaction or a complex attack path?

Company

Resources

Contact

Frequently Asked Questions

Which users can exploit this issue?

What data and actions are exposed if exploitation succeeds?

Does exploitation require user interaction or a complex attack path?