CVE-2026-118644
Deferred Deferred - Pending Action

Identity Spoofing in n8n Workflow Error Handling

Publication date: 2026-10-28

Last updated on: 2026-10-28

Assigner: VulnCheck

Description
n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-28
Last Modified
2026-10-28
Generated
2026-10-28
AI Q&A
2026-10-28
EPSS Evaluated
N/A
NVD
CVE-2026-118644
EUVD
EUVD-2026-112375

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
n8n-io n8n 2.42.0
n8n-io n8n 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-266 A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

n8n before versions 2.41.5 and 2.42.2 has a flaw where a failed workflow's full execution context, including the user who started it, is passed to an error workflow. A project editor can manipulate this by setting another user's workflow to use their own error workflow, allowing them to inherit the colleague's identity and access their dynamic credential secrets.

Impact Analysis

If you use n8n versions before 2.41.5 or 2.42.2, an attacker with project editor access could steal your credentials or impersonate you. This could lead to unauthorized access to systems, data breaches, or further exploitation within your workflow environment.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. It may result in data breaches, unauthorized disclosures, and non-compliance with access control and audit logging mandates.

Mitigation Strategies

Upgrade n8n to version 2.41.5 or later for the 2.41.x branch, or to version 2.42.2 or later for the 2.42.x branch to address the issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-118644. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart