EUVD-2026-112381

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to...

CVE-2026-118675

The software n8n versions before 1.123.85 , 2.43.5 , and 2.44.1 is vulnerable to a credential guard bypass (CWE-863). The root cause allows editors of shared workflows to access restricted credentials by configuring the Execute Sub-workflow node with a source url or localFile . This configuration...

CVE-2026-118675 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to...

CVE-2026-118649 n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as proto makes the Data Table project check match every project. An authenticated member who can create and run workflows can list,...

CVE-2026-118649

The n8n workflow automation tool is vulnerable to an authorization bypass in versions before 2.43.5 and 2.44.x before 2.44.1 . The application accepts a client-supplied workflow ID to cache the owner project in memory; providing a crafted ID like __proto__ causes the Data Table project check to m...

CVE-2026-118649 n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as proto makes the Data Table project check match every project. An authenticated member who can create and run workflows can list,...

CVE-2026-118644

The n8n automation platform is vulnerable in versions before 2.41.5 and 2.42.x before 2.42.2 due to improper handling of workflow execution contexts. When a workflow fails, the system passes the full execution context—including the identity of the user who initiated the run—to the configured erro...

CVE-2026-118644 n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the...

CVE-2026-118644 n8n before 2.41.5 and 2.42.2 Credential Theft via Error-Workflow Context Inheritance

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the...

CVE-2026-118642 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline...

EUVD-2026-112373

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline...

CVE-2026-118642

The software n8n versions before 1.123.85, 2.43.5, and 2.44.1 is vulnerable to an authorization bypass (CWE-863). This flaw allows authenticated members to access restricted credentials by using inline sub-workflow nodes with non-boolean disabled values. Specifically, an attacker who knows a cred...

CVE-2026-118642 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline...

CVE-2026-118640

The software n8n versions before 1.123.85 , 2.43.5 , and 2.44.1 is affected by an authorization bypass vulnerability in the Chat Hub component. This flaw allows users with the global:chatUser role to register restricted tool types, enabling them to add and run tools via chat. Successful exploitat...

Blackash-CVE-2025-68613

🚨 CVE-2025-68613 — Critical RCE in n8n Severity: 🔴 Critical Impact: Remote Code Execution Affected Platform: n8n workflow automation 🧩 Overview CVE-2025-68613 is a critical security vulnerability in n8n , an open-source workflow automation platform. The issue allows an authenticated attacker to...

gha-lab-232af4821f

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of BraveUX/for-the-badge at commit...

gha-lab-8e9316151c

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gradio-app/gradio at commit...

gha-lab-d9fd584b12

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of DIYgod/RSSHub at commit...

gha-lab-6255f5fc33

Automated research artifact — not the upstream project. This repository is a disposable lab built by an automated harness for a master's thesis at Université Laval on reproducing published GitHub Actions workflow vulnerabilities. It is a verbatim snapshot of gradio-app/gradio at commit...

CVE-2026-33017

CVE-2026-33017 — Langflow Unauthenticated Remote Code Execution Author: dynamo2k1 Severity: Critical CVSSv3: 9.8 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Overview CVE-2026-33017 is a critical unauthenticated Remote Code Execution vulnerability in Langflow, an open-source platform for visually building...