CVE-2026-118644 Details

A vulnerability in n8n versions prior to 2.41.5 and 2.42.2 allows for credential theft by improperly handling execution contexts in error workflows. When a workflow fails, n8n passes the full execution context, including the identity of the user who initiated the run, to a designated error workflow. This flaw enables a project editor to redirect a colleague's error workflow to one they control, thereby inheriting the colleague's identity and accessing their per-user dynamic credential secrets. The vulnerability arises from incorrect privilege assignments, allowing unauthorized access to sensitive credentials.

Users can upgrade to n8n versions 2.42.2 or 2.41.5 to address this vulnerability. If an immediate upgrade is not possible, it is recommended to restrict access to the n8n instance to trusted users, audit team project memberships to remove editor access from untrusted users, review active workflows for unexpected error workflow settings, and disable the dynamic credentials feature if not needed.