CVE-2026-118642n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows

Açıklama

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Kaynaklar ve yamalar

• GitHub Security Advisory (GHSA-8vrr-mgc5-jg55) vendor-advisory
• VulnCheck Advisory: n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows third-party-advisory