---
id: CVE-2026-118647
title: >-
  n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure
  via Execution Data
summary: >-
  n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the
  SeaTable Trigger node's API token in error execution data, because failed poll
  requests store raw request headers. Users who can view workflow executions but
  cann…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-532
vendor: n8n-io
product: n8n
affected:
  - n8n < 1.123.85
  - n8n >= 2.44.0 < 2.44.1
  - n8n >= 2.0.0 < 2.43.5
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T18:59:46.290Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-118647'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-crfj-5wv6-8v86'
    label: GitHub Security Advisory (GHSA-crfj-5wv6-8v86)
  - url: >-
      https://www.vulncheck.com/advisories/n8n-before-1.123.85-2.43.5-and-2.44.1-seatable-trigger-api-token-exposure-via-execution-data
    label: >-
      VulnCheck Advisory: n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable
      Trigger API Token Exposure via Execution Data
tags:
  - cve.org
epss: 0.00256
epssPercentile: 0.17325
ingestedAt: '2026-10-29T15:37:07.540Z'
---

## Overview

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.

## Affected

- `n8n < 1.123.85`
- `n8n >= 2.44.0 < 2.44.1`
- `n8n >= 2.0.0 < 2.43.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.