CVE-2026-118675
7.1 HIGHpublic exploit availablePublished 2026-10-28 · Updated 2026-10-28
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N
Weaknesses
CWE-863
Public exploit & PoC references
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- HIGHCVE-2024-22031PoC
- HIGHCVE-2026-100105
- MEDIUMCVE-2026-100145
- MEDIUMCVE-2026-100259
- HIGHCVE-2026-100262
- LOWCVE-2026-100270
- HIGHCVE-2026-100273
- MEDIUMCVE-2026-100276
Related by shared AI tags and CWE weakness class. Browse the full archive.