CVE-2026-118642: n8n authorization bypass in inline sub-workflow credential check

CVE-2026-118642 · Severity: high · CVSS 7.1 · Published 2026-10-28

n8n is a workflow automation platform that enables users to connect applications and automate tasks. An authenticated member can bypass credential permission checks by running workflows with specially crafted nodes, gaining access to decrypted credentials they should not be able to use. An attacker could exfiltrate sensitive credentials to an attacker-controlled server.

Technologies: N8n. Vendors: N8n.

Quick answers

Is CVE-2026-118642 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-118642 being exploited in the wild.
How severe is CVE-2026-118642?
High severity, with a CVSS score of 7.1, published 28 October 2026.
Which products and versions are affected?
N8n before 1.123.85, 2.43.5, and 2.44.1.
Is there a fix for CVE-2026-118642?
Yes: fixed in n8n 1.123.85, 2.43.5, 2.44.1. Until then: Restrict n8n instance access to fully trusted users only. Audit execution logs for unexpected successful executions of Execute Workflow nodes using inline JSON mode, and remove member access from users who are not fully trusted until the instance is patched. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118642 attacked?
It is attacked over the network.
Am I affected by CVE-2026-118642?
Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: n8n 1.123.85, 2.43.5, 2.44.1

Restrict n8n instance access to fully trusted users only. Audit execution logs for unexpected successful executions of Execute Workflow nodes using inline JSON mode, and remove member access from users who are not fully trusted until the instance is patched.

Technical details

The vulnerability exists in the authorization check logic that verifies user access to credentials before workflow execution. When a workflow node has a non-boolean disabled value within an inline sub-workflow, the permission check and execution engine disagree on whether the node is disabled, allowing it to execute and access restricted credentials. An authenticated attacker who knows a credential ID can exploit this by running an Execute Workflow node in inline JSON mode to exfiltrate the decrypted credential.

Affected products

  • n8n n8n before 1.123.85, 2.43.5, and 2.44.1

Timeline

  • 2026-10-14: disclosed
  • 2026-10-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.