CVE-2026-54305

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.2

Description Three Enterprise Edition endpoints used by the Dynamic Credentials feature fail to perform per-resource ownership or scope checks on target workflows or credentials. This allows an authenticated user, regardless of project membership or credential sharing permissions, to enumerate credential identifiers, names, and types referenced by any private workflow. Additionally, an attacker can initiate an OAuth authorization flow to overwrite another user's stored tokens with tokens from an account they control or revoke those tokens entirely. Consequently, workflows using hijacked credentials execute under the attacker's OAuth identity, potentially leading to data exfiltration to external services and persistent takeover of integrations. This issue specifically affects Enterprise instances with the Dynamic Credentials feature enabled.

Recommendations Update to version 1.123.55. Update to version 2.25.7. Update to version 2.26.2. Restrict instance access to fully trusted users only. Disable the Dynamic Credentials feature by unsetting the N8N ENV FEAT DYNAMIC CREDENTIALS variable.