n8n CVE-2026-110850

Requires an authenticated editor-level account (PR:L) on an n8n instance running a version before 2.41.4 or 2.42.0 before 2.42.1. A shared workflow that references the owner's (a different, higher-trust user's) stored credentials must exist, and the attacker must be able to add or edit a 'Message an Agent' node configured in inline mode with attacker-controlled tools. The flaw triggers specifically because the save-time validation inspects only the node's credentials field and does not validate credential ids stored in agent node parameters. Limiting factors: this is not remote-unauthenticated - it needs editor rights plus a multi-user/shared-workflow deployment, so single-operator self-hosted instances have little practical exposure.

This is a credible but access-gated authorization flaw (CWE-863), not a mass-exploitation threat. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N, VC:H, SC:H/SI:H) scores 7.2 HIGH and is internally consistent with the description: AV:N reflects network reachability of the n8n editor UI, PR:L confirms the attacker must be an authenticated editor (NOT unauthenticated), and AT:P captures the real-world precondition that a shared workflow referencing the owner's credentials must exist. The scope/subsequent-system impacts (SC:H/SI:H) correctly model that an editor abuses the system to exfiltrate ANOTHER user's (the owner's) decrypted secrets - a privilege/trust-boundary crossing rather than straightforward self-service access. Exploitation status: no public exploit identified at time of analysis (no CISA KEV listing and no POC referenced in the provided sources). EPSS is not provided, so widespread opportunistic exploitation probability cannot be quantified from this data. Net: the real priority depends heavily on deployment model - for multi-tenant or team n8n instances where editors are semi-trusted, this is a meaningful insider/credential-theft risk worth prompt patching; for single-operator self-hosted instances the practical exposure is low because the attacker already needs editor rights. Treat as a targeted/insider-abuse issue, not an internet-wide worming threat.

A malicious or compromised editor on a shared n8n instance opens a workflow owned by a higher-trust user that references the owner's stored credentials. The editor adds or reconfigures a 'Message an Agent' node in inline mode wired to attacker-controlled tools; because n8n only validates the node's credentials field and not the credential ids embedded in agent node parameters, the save succeeds and the node resolves and decrypts the owner's secrets, sending them to an attacker-chosen destination. No public exploit code is identified at this time, and exploitation requires authenticated editor access (PR:L), lowering opportunistic risk.