CVE-2026-42227 Details
Description
n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, an authenticated user with a valid API key scoped to variable:list could read variables from projects they are not a member of by supplying an arbitrary projectId query parameter to the public API variables endpoint. The handler queried the variables repository directly without enforcing project membership checks, bypassing the authorization-aware service layer used by the internal enterprise controller. If variables were misused to store sensitive information such as credentials or tokens, they should be rotated immediately. This issue only affects licensed enterprise or team deployments with multiple projects and the variables feature enabled. This issue has been patched in versions 1.123.32, 2.17.4, and 2.18.1.
A vulnerability in n8n's public API variables endpoint allows authenticated users with a valid API key scoped to 'variable:list' to access variables from projects they do not belong to. This issue affects n8n versions prior to 1.123.32, 2.17.4, and 2.18.1, and is present in licensed enterprise or team deployments with multiple projects and the variables feature enabled. The vulnerability arises because the API endpoint bypasses project membership checks, directly querying the variables repository and circumventing the authorization-aware service layer of the internal enterprise controller. As a result, if sensitive information such as credentials or tokens was stored in the variables, it could be improperly accessed and should be rotated immediately.
Users should upgrade to n8n versions 1.123.32, 2.17.4, or 2.18.1. If an immediate upgrade is not possible, access to n8n and API key issuance should be restricted to trusted users only, and existing project variables should be audited for sensitive information, with any exposed secrets rotated.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-756q-gq9h-fp22 | [email protected] | Vendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.32 >= 2.17.0, < 2.17.4 2.18.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 6, 2026 | Initial Analysis | [email protected] |
| May 4, 2026 | New CVE Received | [email protected] |