https://feed.craftedsignal.io/products/n8n--2.41.5-2.42.x--2.42.2/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 20:38:29 +0000https://feed.craftedsignal.io/favicon-32x32.pnghttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svghttps://feed.craftedsignal.io/briefs/2026-10-n8n-privilege-escalation/Wed, 28 Oct 2026 20:38:29 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-n8n-privilege-escalation/A vulnerability in n8n allows a project editor to intercept a colleague's failed workflow execution context and assume their identity to resolve per-user dynamic credential secrets.<p>A vulnerability exists in n8n where a failed workflow's full execution context, including the identity of the user who started the run, is passed to the configured error workflow. A project editor can set a colleague's <code>settings.errorWorkflow</code> to an error workflow they own. When the colleague's workflow fails, the attacker can inherit the colleague's identity and resolve the colleague's per-user dynamic credential secrets. This affects n8n before 2.41.5 and 2.42.x before 2.42.2.</p> highadvisory