Is CVE-2026-118647 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118647 being exploited in the wild.

How severe is CVE-2026-118647?

High severity, with a CVSS score of 8.2, published 28 October 2026.

Which products and versions are affected?

N8n before 1.123.85, 2.x before 2.43.5, 2.44.x before 2.44.1.

How is CVE-2026-118647 attacked?

It is attacked over the network.

Am I affected by CVE-2026-118647?

Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118647: n8n SeaTable Trigger node API token exposure in execution data

CVE-2026-118647 · Severity: high · CVSS 8.2 · Published 2026-10-28

n8n is a workflow automation platform that integrates with external services like SeaTable. The SeaTable Trigger node stores API tokens in execution logs when poll requests fail, allowing users who can view workflow executions but lack credential access to recover and misuse the token to access connected SeaTable databases. An attacker with execution viewing permissions could obtain credentials without reading the actual credential vault.

Technologies: N8n. Vendors: N8n.

Quick answers

Is CVE-2026-118647 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118647 being exploited in the wild.
How severe is CVE-2026-118647?: High severity, with a CVSS score of 8.2, published 28 October 2026.
Which products and versions are affected?: N8n before 1.123.85, 2.x before 2.43.5, 2.44.x before 2.44.1.
Is there a fix for CVE-2026-118647?: Yes: fixed in n8n 1.123.85, 2.43.5, 2.44.1. Until then: Restrict n8n instance access to fully trusted users, deactivate SeaTable poll-trigger workflows until patched, rotate SeaTable API tokens and audit recent executions for token exposure, and restrict execution read access to the minimum set of users who require it. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118647 attacked?: It is attacked over the network.
Am I affected by CVE-2026-118647?: Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: n8n 1.123.85, 2.43.5, 2.44.1

Restrict n8n instance access to fully trusted users, deactivate SeaTable poll-trigger workflows until patched, rotate SeaTable API tokens and audit recent executions for token exposure, and restrict execution read access to the minimum set of users who require it.

Technical details

The vulnerability is information disclosure (CWE-532) in n8n's SeaTable Trigger node, which includes raw HTTP request headers containing the SeaTable API token in error execution logs when polling fails. An authenticated user with workflow execution view permissions but no credential read access can inspect execution data to recover the token. The fix involves filtering sensitive headers from error responses before storing execution data.

Affected products

n8n n8n before 1.123.85, 2.x before 2.43.5, 2.44.x before 2.44.1

Timeline

2026-10-14: disclosed
2026-10-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.