n8n: Credential Exfiltration via Permission Bypass
n8n
- Severity
- Critical, CVSS 9.6
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
- Record
- CVE-2026-54307
- Affects
- n8n
- Known exploited
- Not listed in the CISA Known Exploited Vulnerabilities catalog
- Published
- Record first published by the source
- June 23, 2026
- Source last modified
- October 25, 2026
Description
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential ownership checks were only enforced partially leading to cross-user credential access. This issue affects instances where workflow sharing is enabled and at least one workflow has been shared with a member-level user as an Editor. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.
Description quoted from the NVD record.
Who is affected
n8n is a tool for connecting different apps and automating routine tasks. This flaw affects versions before 1.123.55, 2.25.7 and 2.26.2. It matters only where workflow sharing is turned on and at least one workflow has been shared with a member-level user as an Editor. Such a user could reach saved login details (credentials) that belong to other users, through the product's public programming interface, because checks on who owns those login details were only partly enforced. This flaw is rated Critical.
What to do
- The person who installed or runs n8n for your organization should act on this. If an IT provider or vendor manages it for you, send them this advisory and ask when the update will be done.
- Update n8n to a fixed version:
1.123.55,2.25.7or2.26.2(or later). - Find out whether workflow sharing is turned on and whether any workflow is shared with a member-level user as an Editor, since those are the setups this flaw affects.
- Check the vendor advisory linked on this page for details on the fixed releases.
Analysis written from the source record as of October 25, 2026 and reviewed before publishing.