n8n: Unauthorized credential access via error workflow execution (CVE-2026-118644)
A vulnerability in n8n allows a project editor to intercept a colleague's failed workflow execution context and assume their identity to resolve per-user dynamic credential secrets.
CVE search metadata
CVE search record: CVE-2026-118644. Severity: high. CVSS: 7.7. KEV: no. Product: n8n (< 2.41.5, 2.42.x < 2.42.2). Brief: n8n: Unauthorized credential access via error workflow execution (CVE-2026-118644). Brief link: https://feed.craftedsignal.io/briefs/2026-10-n8n-privilege-escalation/
Triage facts
Revision 1- Applicability
- n8n (< 2.41.5, 2.42.x < 2.42.2)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 28, 20:38 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
A vulnerability exists in n8n where a failed workflow's full execution context, including the identity of the user who started the run, is passed to the configured error workflow. A project editor can set a colleague's settings.errorWorkflow to an error workflow they own. When the colleague's workflow fails, the attacker can inherit the colleague's identity and resolve the colleague's per-user dynamic credential secrets. This affects n8n before 2.41.5 and 2.42.x before 2.42.2.