CVE-2026-110850

— UNSCOREDpublic exploit available

Published 2026-10-14 · Updated 2026-10-15

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to resolve the owner's credentials and send decrypted secrets to an attacker-chosen destination.

Weaknesses

CWE-863

Public exploit & PoC references

https://github.com/n8n-io/n8n/security/advisories/GHSA-x25p-9mr6-cwgp

All references

https://github.com/n8n-io/n8n/security/advisories/GHSA-x25p-9mr6-cwgp
https://www.vulncheck.com/advisories/n8n-before-2.41.4-and-2.42.1-credential-check-bypass-via-agent-node-parameters

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2024-22031PoC
MEDIUMCVE-2026-100259
HIGHCVE-2026-100262
LOWCVE-2026-100270
HIGHCVE-2026-100273
MEDIUMCVE-2026-100276
HIGHCVE-2026-100277
MEDIUMCVE-2026-100278

Related by shared AI tags and CWE weakness class. Browse the full archive.