CVE-2026-118644 n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118644?
CVE-2026-118644 is a medium-severity vulnerability in n8n-io n8n, published on 28 Oct 2026.
Official description
n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.
Weakness: CWE-266
Which versions are affected by CVE-2026-118644?
How do I fix CVE-2026-118644?
No fix has been published for CVE-2026-118644 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118644 being exploited?
There is no known exploitation of CVE-2026-118644 in the wild and no public exploit code.
Sources
Also known as GHSA-cfc8-9wgc-86cf, GHSA-pcr3-v5vr-qppf.