CVE-2026-118642

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.85 n8n versions prior to 2.43.5 n8n versions prior to 2.44.1

Description An authorization bypass allows authenticated members to utilize credentials they are not permitted to access. This occurs through inline sub-workflow nodes when non-boolean values are used in the disabled parameter. An attacker with knowledge of a credential ID can use Execute Workflow nodes in inline JSON mode to bypass permission checks and transmit decrypted credentials to external servers under their control.

Recommendations Update n8n to version 1.123.85 or later. Update n8n to version 2.43.5 or later. Update n8n to version 2.44.1 or later.