Advisory · CVE-2026-118647
n8n SeaTable trigger token leaks through execution error data
Failed SeaTable Trigger polls store raw request headers in execution data, letting execution viewers recover the SeaTable API token. Rated 8.2.
- Vendor
- n8n
- Product
- n8n
- Identifier / CWE
- CVE-2026-118647
CWE-532 - Action timing
- Immediate
Explain it like I’m five
When a SeaTable poll fails, n8n files the whole request, headers and all, in the failure report. The API token sits in those headers for anyone who can read reports.
- 01Failed poll
A SeaTable Trigger poll request fails.
- 02Raw headers stored
The failed request stores raw request headers in error execution data.
- 03Token recovered
A user who can view executions but cannot read the credential recovers the SeaTable API token and accesses the connected base.
What happened
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node’s API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base. The CVSS 3.1 score is 8.2.
Like the sibling error-data flaw in the same release set, this turns execution-view permission into credential-read permission, so the fix is the upgrade plus token rotation, not the upgrade alone.
What to do
- Inventory n8n instances using the SeaTable Trigger node.
- Upgrade to 1.123.85, 2.43.5, or 2.44.1 on the matching release line.
- Limit who can view workflow executions until patched.
- Rotate SeaTable API tokens for affected instances.
- Confirm the deployed version after patching.
Management note
Tokens in logs and error data keep causing the same incident: the audience for failure reports is always wider than the audience for secrets. Rotate first, then tighten who sees executions.