CVE-2026-118643

The software n8n is vulnerable in versions before 1.123.85 , 2.x before 2.43.5 , and 2.44.x before 2.44.1 . The root cause is that the application stores credential secrets within execution error data when operations fail in specific nodes, namely Git , MongoDB Atlas Vector Store , and Google Clo...

CVE-2026-118643 n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git...

CVE-2026-118643: n8n-io n8n: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when…

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git...

EUVD-2026-70406

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to...