CVE-2026-118642 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows

Medium 5.1 Published 28 Oct 2026 Updated 28 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-118642?

CVE-2026-118642 is a medium-severity vulnerability in n8n-io n8n, published on 28 Oct 2026.

Official description

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.

Weakness: CWE-863

Which versions are affected by CVE-2026-118642?

How do I fix CVE-2026-118642?

No fix has been published for CVE-2026-118642 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-118642 being exploited?

There is no known exploitation of CVE-2026-118642 in the wild and no public exploit code.

Sources

Also known as GHSA-8vrr-mgc5-jg55, GHSA-x95v-p35j-q7f5.