CVE-2026-85171
Received Received - Intake

Credential Exposure in n8n Workflow Automation Platform

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulnCheck

Description
n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-85171
EUVD
EUVD-2026-70406

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
n8n n8n to 1.123.73 (exc)
strapi strapi *
seatable seatable *
mailcheck mailcheck *
n8n n8n 2.35.4
n8n n8n 2.36.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-532 The product writes sensitive information to a log file.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects n8n versions before 1.123.73, 2.35.4, and 2.36.2. It involves the Strapi, SeaTable, and Mailcheck nodes leaking decrypted credential secrets into persisted execution error data. When these nodes send decrypted credentials to authentication endpoints using legacy HTTP helpers without proper error handling, plaintext secrets are stored in execution errors. Authenticated users can then retrieve these secrets via the REST API, bypassing the credentials API's blank-value redaction.

Detection Guidance

Check n8n execution logs for plaintext credentials in error messages from Strapi, SeaTable, or Mailcheck nodes. Use API calls to inspect execution records via the REST API for exposed secrets.

Impact Analysis

An attacker with authenticated access could retrieve plaintext credentials from execution error logs via the REST API. This could lead to unauthorized access to sensitive systems, data breaches, or further exploitation of connected services using the exposed credentials.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA due to unauthorized exposure of sensitive data. GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. The credential exposure may violate confidentiality requirements and data protection obligations under these regulations.

Mitigation Strategies
  • Upgrade n8n to versions 1.123.73, 2.35.4, or 2.36.2 or later.
  • Disable the Strapi, SeaTable, and Mailcheck nodes if upgrading is not immediately possible.
  • Restrict API access to trusted users only.
  • Audit execution records for any exposed credentials and rotate them if found.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85171. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart