CVE-2026-85171 PUBLISHED

n8n before 1.123.73 Credential Exposure via Error Logging

Assigner: VulnCheck
Reserved: 03.09.2026 Published: 03.09.2026 Updated: 03.09.2026

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS Score: 7.1

Product Status

Vendor n8n-io
Product n8n
Versions Default: unaffected
  • affected from 0 to 1.123.73 (excl.)
  • Version 1.123.73 is unaffected
Vendor n8n-io
Product n8n
Versions Default: unaffected
  • affected from 0 to 2.36.2 (excl.)
  • Version 2.36.2 is unaffected
Vendor n8n-io
Product n8n
Versions Default: unaffected
  • affected from 0 to 2.35.4 (excl.)
  • Version 2.35.4 is unaffected

Credits

  • Masofgon reporter

References

Problem Types

  • Insertion of Sensitive Information into Log File CWE