Executive brief
n8n is an automation platform used to connect different software services and manage business workflows. A security flaw allows users with 'Editor' access to a shared workflow to access sensitive credentials belonging to other users that they should not be able to see. This could lead to the unauthorized use of third-party service accounts or the exposure of private API keys and passwords.
Technical details
An incorrect authorization vulnerability (CWE-863) exists in n8n's workflow sharing mechanism. The root cause is a partial enforcement of credential ownership checks within specific public API endpoints. An attacker with 'Editor' privileges on a shared workflow can exploit this by referencing and potentially exfiltrating credentials owned by other users. This requires the attacker to have an account on the instance and for workflow sharing to be enabled. The vulnerability is resolved in versions 1.123.55, 2.25.7, and 2.26.2 by implementing stricter ownership validation.
Affected products
- n8n-io n8n < 1.123.55, >= 2.0.0-rc.0 < 2.25.7, >= 2.26.0 < 2.26.2
Timeline
- 2026-06-10: advisory: GitHub Security Advisory published by n8n-io
- 2026-06-23: disclosed: CVE published to NVD dataset