CVE-2026-118644

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.41.5 n8n versions 2.42.x prior to 2.42.2

Description The software passes the full execution context of a failed workflow, including the identity of the user who initiated the run, to the configured error workflow. This allows a project editor to set the settings.errorWorkflow of a colleague's workflow to an error workflow they own. Consequently, the editor can inherit the colleague's identity upon workflow failure and resolve the colleague's per-user dynamic credential secrets.

Recommendations Update n8n to version 2.41.5 or later. Update n8n versions 2.42.x to 2.42.2 or later.