Which versions of n8n are affected by EUVD-2026-38478?

n8n versions prior to 1.123.55 and 2.0.0-rc.0 through 2.26.2 contain a cross-user credential access vulnerability allowing member-level users to retrieve credentials owned by other users in shared…. A patch is available.

How to fix or mitigate EUVD-2026-38478?

Within 24 hours: Inventory all n8n deployments and identify affected versions (pre-1.123.55, 2.0.0-rc.0 through 2.25.7, 2.26.0 through 2.26.2); determine which instances have workflow sharing enabled. Within 7 days: Apply patched n8n versions per vendor security advisory; disable workflow sharing temporarily if patching is delayed. Within 30 days: Rotate all credentials stored in shared workflows; audit access logs for unauthorized credential API endpoint references.

n8n EUVD-2026-38478

Q: What is the CVSS score of EUVD-2026-38478?

EUVD-2026-38478 has a CVSS 4.0 base score of 8.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-54307 HIGH

Incorrect Authorization (CWE-863)

2026-06-16 https://github.com/n8n-io/n8n

GHSA-pmqw-72cg-wx85

Authentication Bypass

8.5

CVSS 4.0 · Vendor: https://github.com/n8n-io/n8n

Severity by source

Vendor (https://github.com/n8n-io/n8n) PRIMARY

8.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network API exploitable by an authenticated member (PR:L), no UI; credential disclosure crosses authorization boundary (S:C, C:H), no integrity or availability impact on n8n itself.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (https://github.com/n8n-io/n8n).

CVSS VectorVendor: https://github.com/n8n-io/n8n

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Updated

Jun 23, 2026 - 18:40 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jun 23, 2026 - 18:22 vuln.today

cvss_changed

CVSS changed

Jun 23, 2026 - 18:22 NVD

9.6 (HIGH) 8.5 (HIGH)

Source Code Evidence Fetched

Jun 17, 2026 - 00:10 vuln.today

Analysis Generated

Jun 17, 2026 - 00:10 vuln.today

DescriptionCVE.org

Impact

A member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential ownership checks were only enforced partially leading to cross-user credential access.

This issue affects instances where workflow sharing is enabled and at least one workflow has been shared with a member-level user as an Editor.

Patches

The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

Restrict workflow sharing to fully trusted users only.
Audit shared workflows for unexpected credential references or recent modifications.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Credits: Momen Elkhouli

AnalysisAI

Cross-user credential access in n8n workflow automation platform allows member-level users with Editor access to shared workflows to reference credentials owned by other users via specific public API endpoints. The flaw stems from incomplete ownership checks (CWE-863) and affects versions prior to 1.123.55, between 2.0.0-rc.0 and 2.25.7, and between 2.26.0 and 2.26.2. No public exploit identified at time of analysis, but the vulnerability enables credential exfiltration in multi-tenant n8n deployments where workflow sharing is enabled.

Technical ContextAI

n8n is a fair-code workflow automation platform distributed as the npm package 'n8n' that orchestrates integrations across SaaS services using stored credentials. The vulnerability is rooted in CWE-863 (Incorrect Authorization): the public API endpoints that resolve credential references attached to a workflow performed only partial ownership verification, checking workflow access but failing to verify that the requesting user owned (or was granted access to) the referenced credentials. As a result, an Editor on a shared workflow could invoke API calls that disclosed or operated against credentials belonging to the workflow owner or other users, breaking the platform's role-based access control model.

RemediationAI

Vendor-released patches are available: upgrade to n8n 1.123.55, 2.25.7, or 2.26.2 (or any later release on the corresponding branch) per the GHSA advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-pmqw-72cg-wx85. If immediate upgrade is not possible, restrict workflow sharing to fully trusted users only (acknowledging this reduces collaboration capability) and audit all currently shared workflows for unexpected credential references or recent modifications by Editor-role users; these workarounds reduce but do not eliminate the risk and should be considered short-term only. Operators should also rotate any credentials stored in n8n that were referenced by shared workflows on vulnerable instances, since prior exfiltration cannot be ruled out from configuration alone.