AI Threat AlertCVE-2026-110850: n8n: credential check bypass leaks secrets via agent
HIGHn8n versions before 2.41.4, and 2.42.0 before 2.42.1, fail to validate credential IDs placed in agent node parameters when an editor saves a shared workflow, because the authorization check only inspects a node's credentials field. A low-privileged editor can build a Message an Agent node in inline mode with attacker-controlled tools so that the owner's credentials are resolved and the decrypted secrets are sent to a destination of their choosing. No CVSS, EPSS or KEV data is available yet and there is no public exploit or Nuclei template, so exploitation likelihood is unquantified. Even so, the attack needs only editor access and no special AI expertise, and n8n workflows typically hold high-value API keys, database passwords and OAuth tokens. Upgrade to 2.41.4 or 2.42.1 now, restrict editor rights on shared workflows, and rotate any credentials that were shared with untrusted editors.
What is the risk?
Medium-to-high risk, pending an official CVSS score. The flaw is an incorrect authorization check (CWE-863) that needs authenticated editor access, which limits the exposed population to insiders and compromised editor accounts. Impact is high on confidentiality because decrypted credentials for connected systems can be exfiltrated. Exploitation is straightforward through the standard workflow editor. There is no KEV listing, no known public exploit and no scanner template as of publication, but the advisory detail lowers the effort needed to reproduce it. Multi-user and shared-project n8n deployments carry the most exposure.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 step1) Upgrade n8n to 2.41.4 or later, or to 2.42.1 or later on the 2.42 line. 2) Until patched, limit editor roles on shared workflows and projects to trusted users only. 3) Review recently saved workflows for Message an Agent nodes in inline mode that reference credential IDs outside the editor's own set, and for unexpected outbound HTTP or tool destinations. 4) Rotate credentials owned by users who shared workflows with editors you cannot fully trust, prioritizing LLM API keys, database and cloud credentials. 5) Monitor egress traffic from the n8n host for connections to unfamiliar domains and alert on workflow-edit audit events by non-owners. 6) Apply least-privilege scopes to the credentials stored in n8n to reduce the blast radius.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-110850?
n8n versions before 2.41.4, and 2.42.0 before 2.42.1, fail to validate credential IDs placed in agent node parameters when an editor saves a shared workflow, because the authorization check only inspects a node's credentials field. A low-privileged editor can build a Message an Agent node in inline mode with attacker-controlled tools so that the owner's credentials are resolved and the decrypted secrets are sent to a destination of their choosing. No CVSS, EPSS or KEV data is available yet and there is no public exploit or Nuclei template, so exploitation likelihood is unquantified. Even so, the attack needs only editor access and no special AI expertise, and n8n workflows typically hold high-value API keys, database passwords and OAuth tokens. Upgrade to 2.41.4 or 2.42.1 now, restrict editor rights on shared workflows, and rotate any credentials that were shared with untrusted editors.
Is CVE-2026-110850 actively exploited?
No confirmed active exploitation of CVE-2026-110850 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-110850?
1) Upgrade n8n to 2.41.4 or later, or to 2.42.1 or later on the 2.42 line. 2) Until patched, limit editor roles on shared workflows and projects to trusted users only. 3) Review recently saved workflows for Message an Agent nodes in inline mode that reference credential IDs outside the editor's own set, and for unexpected outbound HTTP or tool destinations. 4) Rotate credentials owned by users who shared workflows with editors you cannot fully trust, prioritizing LLM API keys, database and cloud credentials. 5) Monitor egress traffic from the n8n host for connections to unfamiliar domains and alert on workflow-edit audit events by non-owners. 6) Apply least-privilege scopes to the credentials stored in n8n to reduce the blast radius.
What systems are affected by CVE-2026-110850?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM-orchestrated tool pipelines, multi-tenant shared workflow environments.
What is the CVSS score for CVE-2026-110850?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0081Modify AI Agent ConfigurationAML.T0083Credentials from AI Agent ConfigurationAML.T0086Exfiltration via AI Agent Tool InvocationAML.T0098AI Agent Tool Credential HarvestingCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 2.41.4 and 2.42.0 before 2.42.1 does not validate credential ids stored in agent node parameters when an editor saves a shared workflow, because the check inspects only a node's credentials field. An editor can configure a Message an Agent node in inline mode with tools they control to resolve the owner's credentials and send decrypted secrets to an attacker-chosen destination.
Exploitation Scenario
A contractor with editor access to a shared n8n project opens a workflow owned by the platform team. They add a Message an Agent node in inline mode and attach a tool they control, setting a parameter to the credential ID of the owner's production API key. The save-time check inspects only the node's credentials field, so the reference passes validation. When the workflow runs, n8n resolves the owner's credential and the agent tool transmits the decrypted secret to an attacker-controlled endpoint. The attacker then uses the key to access the LLM provider account, internal databases or SaaS systems.
Weaknesses (CWE)
CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n