High priorityDisclosed

Advisory · CVE-2026-118649

n8n Data Table authorization bypass via crafted workflow ID

A crafted workflow ID makes the Data Table project check match every project, letting an authenticated member read, modify, and delete rows in all projects. Rated 8.7 on CVSS 4.0.

Advisory published October 28, 2026Independent summary
Vendor
n8n
Product
n8n
Identifier / CWE
CVE-2026-118649
CWE-1321
Action timing
Immediate
ELI5

Explain it like I’m five

The system files each workflow's owner project under an ID the user supplies. A magic ID makes the check match every project, so one member's key opens every project's data tables.

SIMPLIFIED_ATTACK_PATH04 STEPS
  1. 01Crafted workflow ID

    An authenticated member creates and runs workflows with a crafted ID such as a prototype value.

  2. 02Owner project cached

    The system caches each workflow's owner project in memory by that client-supplied ID.

  3. 03Check matches all projects

    The Data Table project check matches every project.

  4. 04Cross-project access

    The member lists, reads, modifies, and deletes Data Table rows in all projects of the instance.

What happened

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow’s owner project in memory by that ID, so a crafted ID makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance. The CVSS 4.0 score is 8.7.

Unlike the sibling n8n flaws fixed in the same window, this one is listed only for the 2.x lines (fixed in 2.43.5 and 2.44.1), with no 1.x range stated in the record.

What to do

  1. Inventory n8n 2.x instances using Data Tables.
  2. Upgrade to 2.43.5 or 2.44.1 on the matching release line.
  3. Limit workflow creation rights until patched.
  4. Review Data Table access logs for cross-project activity.
  5. Confirm the deployed version after patching.

Management note

Project isolation is the whole point of multi-project n8n, and this flaw dissolves it with a single crafted ID. Multi-tenant instances should treat this as the top n8n item in the batch.