High priorityDisclosed

Advisory · CVE-2026-118643

n8n leaks credential secrets through workflow execution error data

Failed operations in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes store credential secrets in execution error data, letting execution viewers recover them. Rated 8.2.

Advisory published October 28, 2026Independent summary
Vendor
n8n
Product
n8n
Identifier / CWE
CVE-2026-118643
CWE-209
Action timing
Immediate
ELI5

Explain it like I’m five

When a workflow step fails, n8n writes the failure report with the password still attached. Anyone allowed to read failure reports can pick the password out of it.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01Failing node operation

    A Git, MongoDB Atlas Vector Store, or Google Cloud Storage node operation fails.

  2. 02Secret stored in error data

    The credential secret is stored in the execution error data.

  3. 03Credential recovered

    A user who can view executions but cannot read the credential recovers the Git password or token, database password, or Google access token.

What happened

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow’s executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data. The CVSS 3.1 score is 8.2.

This is one of several n8n credential-handling flaws fixed in the same releases, which together make the upgrade urgent for any multi-user instance: the permission model around credentials is the thing being bypassed.

What to do

  1. Inventory n8n instances, especially multi-user ones.
  2. Upgrade to 1.123.85, 2.43.5, or 2.44.1 on the matching release line.
  3. Limit who can view workflow executions until patched.
  4. Audit execution error data for exposed secrets.
  5. Rotate Git, MongoDB Atlas, and Google Cloud credentials that may have been exposed.
  6. Confirm the deployed version after patching.

Management note

Error data is a classic credential leak channel because it is widely readable by design. Anyone with execution-view access effectively had credential-read access, so rotation is mandatory.