CVE-2026-118647High· 8.2▾ Twilightn8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cann…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 29.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.
n8n < 1.123.85n8n >= 2.44.0 < 2.44.1n8n >= 2.0.0 < 2.43.5Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-65589Medium· 5.1n8n before 1.123.64 Credential Exposure via LLM Node Execution Data
GHSA-fmvg-vhqq-r2mjMediumDuplicate Advisory: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
CVE-2026-119408High· 8.8n8n before 2.42.6, 2.43.3 and 3.0.1 Code Execution Outside Task Runner Isolation via Deprecated Function Nodes
CVE-2026-72775Medium· 5.8n8n before 1.123.67 SQL Injection via PostgresTrigger Node
CVE-2026-72771High· 7.1n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes
CVE-2026-72773Medium· 4.9n8n before 2.32.1 Path Traversal via computer-use search_files