Vulnerabilities / CVE-2026-118643

CVE-2026-118643

Published 2026-10-28 · published (not yet in NVD)

CVE-2026-118643

n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Exposure via Node Execution Error Data

5.3 MEDIUM
CVSS 4.0 · CNA

0.3%
chance of exploitation in the next 30 days (EPSS; higher than 17% of CVEs)

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data.

Scores

5.3CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:H/SA:NCNA

8.2CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:NCNA

Affected products

n8n-io n8n: < 1.123.85
n8n-io n8n: 2.44.0 to < 2.44.1
n8n-io n8n: 2.0.0 to < 2.43.5

Weakness: CWE-209

Also known as: GHSA-qmvv-q3c9-wpp7

2 references (advisories, patches, write-ups)

https://github.com/n8n-io/n8n/security/advisories/GHSA-qmvv-q3c9-wpp7 · vendor-advisory
https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-credential-exposure-via-node-execution-error-data · third-party-advisory

Sources: CVE.org, OSV.dev, FIRST EPSS. Missing ones did not answer or have no record yet.

Look up another CVE Check your dependencies Scan a website