EUVD-2026-70406
GHSA-jjvm-mg9c-jcjc
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable via REST API, low complexity, authenticated user required (PR:L), no UI interaction; only confidentiality impact - plaintext credential exposure, no integrity or availability effect.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
5DescriptionCVE.org
n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.
AnalysisAI
Credential exposure in n8n's Strapi, SeaTable, and Mailcheck integration nodes causes plaintext API secrets to persist in execution error logs, readable by any authenticated user via the REST API. The three affected nodes pass decrypted credentials to external authentication endpoints through a legacy HTTP helper that lacks error-handling wrappers; when those calls fail, the raw secret is written into execution error records rather than being suppressed or redacted. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid authenticated session in the target n8n instance (PR:L - any registered user). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N) scores 7.1 and accurately reflects the threat model: network-reachable, low-complexity, requires only a standard authenticated session, and yields full confidentiality loss of the affected credential. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade n8n to version 1.123.73, 2.35.4, or 2.36.2 (whichever corresponds to the installed branch) as released by n8n-io and documented in the GitHub security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-vrv8-j27g-g7cr. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all n8n instances with Strapi, SeaTable, or Mailcheck integrations and verify current version (vulnerable if below 1.123.73, 2.35.4, or 2.36.2). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Share
External POC / Exploit Code
Leaving vuln.today