CVE-2026-118675 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-118675?
CVE-2026-118675 is a medium-severity vulnerability in n8n-io n8n, published on 28 Oct 2026.
Official description
n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values.
Weakness: CWE-863
Which versions are affected by CVE-2026-118675?
How do I fix CVE-2026-118675?
No fix has been published for CVE-2026-118675 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-118675 being exploited?
There is no known exploitation of CVE-2026-118675 in the wild and no public exploit code.
Sources
Also known as GHSA-2269-xj9w-g6jh, GHSA-8crx-5h96-q72q.