CVE-2026-118643: n8n credential secrets leaked

CISO Take

CVE-2026-118643 is an information disclosure flaw in n8n, the workflow automation platform widely used to orchestrate AI agents. When the Git, MongoDB Atlas Vector Store, or Google Cloud Storage nodes fail, they write credential secrets (Git tokens, MongoDB passwords, Google access tokens) into execution error data, which any user with execution-view rights can read even without credential access. This silently defeats n8n's credential-separation model and could turn a low-privilege or compromised account into access to source repositories, vector databases, and cloud storage. There is no EPSS score, public exploit, Nuclei template, or KEV listing, so near-term mass exploitation is unlikely, but the high CVSS of 8.2 reflects a scope change into downstream systems. Upgrade to 1.123.85, 2.43.5, or 2.44.1 or later, then rotate any Git, MongoDB, and Google credentials used in these nodes and review historical execution data for exposed secrets.

Sources:NVDGitHub AdvisoryVulnCheckATLAS

What is the risk?

High severity (CVSS 8.2) but with constraints: it needs network access, a low-privileged authenticated account with execution-view rights, and a failing node execution (high attack complexity). Scope is changed because leaked credentials grant access to external systems (Git hosts, MongoDB Atlas, Google Cloud). No KEV listing, public exploit, or scanner template is known and EPSS is unavailable. Risk is highest in multi-user or multi-tenant n8n deployments where execution visibility is broader than credential access, and wherever past executions already contain stored secrets. The disclosed secrets stay valid until rotated, so exposure persists after patching.

How does the attack unfold?

Initial Access

Attacker uses a low-privilege n8n account with permission to view workflow executions.

AML.T0012

Credential Exposure

A failed Git, MongoDB Atlas Vector Store, or GCS node run writes its credential secret into the execution error data.

AML.T0055

Credential Harvesting

Attacker reads the execution error data and recovers the Git token, MongoDB password, or Google access token.

AML.T0098

Impact

Attacker uses the stolen credentials to access or tamper with repositories, vector stores, or cloud storage outside n8n.

AML.T0091.000

Initial Access

Attacker uses a low-privilege n8n account with permission to view workflow executions.

AML.T0012

Credential Exposure

A failed Git, MongoDB Atlas Vector Store, or GCS node run writes its credential secret into the execution error data.

AML.T0055

Credential Harvesting

Attacker reads the execution error data and recovers the Git token, MongoDB password, or Google access token.

AML.T0098

Impact

Attacker uses the stolen credentials to access or tamper with repositories, vector stores, or cloud storage outside n8n.

AML.T0091.000

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

8.2 / 10

EPSS

0.3%

chance of exploitation in 30 days

Higher than 17% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SChanged

CHigh

IHigh

ANone

What should I do?

1 step

1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Rotate all Git passwords/tokens, MongoDB Atlas database passwords, and Google access tokens or service account keys used by the affected nodes. 3) Purge or redact historical execution data containing failed runs of these nodes, and check backups, log pipelines, and error-notification destinations. 4) Until patched, restrict execution-view permissions to trusted users and shorten execution data retention. 5) Apply least privilege to the credentials (scoped tokens, read-only DB users, IP allowlists on Atlas). 6) Detect misuse by reviewing Git host, MongoDB Atlas, and Google Cloud audit logs for access from unexpected IPs or by tokens used outside n8n.

How is it classified?

Data LeakageData ExtractionAgentRAGPluginAML.T0012- Valid Accounts AML.T0055- Unsecured Credentials AML.T0083- Credentials from AI Agent Configuration AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Data security and privacy for AI systems

NIST AI RMF

MANAGE 2.3-Response to previously unknown risks

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-118643?

CVE-2026-118643 is an information disclosure flaw in n8n, the workflow automation platform widely used to orchestrate AI agents. When the Git, MongoDB Atlas Vector Store, or Google Cloud Storage nodes fail, they write credential secrets (Git tokens, MongoDB passwords, Google access tokens) into execution error data, which any user with execution-view rights can read even without credential access. This silently defeats n8n's credential-separation model and could turn a low-privilege or compromised account into access to source repositories, vector databases, and cloud storage. There is no EPSS score, public exploit, Nuclei template, or KEV listing, so near-term mass exploitation is unlikely, but the high CVSS of 8.2 reflects a scope change into downstream systems. Upgrade to 1.123.85, 2.43.5, or 2.44.1 or later, then rotate any Git, MongoDB, and Google credentials used in these nodes and review historical execution data for exposed secrets.

Is CVE-2026-118643 actively exploited?

No confirmed active exploitation of CVE-2026-118643 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118643?

1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Rotate all Git passwords/tokens, MongoDB Atlas database passwords, and Google access tokens or service account keys used by the affected nodes. 3) Purge or redact historical execution data containing failed runs of these nodes, and check backups, log pipelines, and error-notification destinations. 4) Until patched, restrict execution-view permissions to trusted users and shorten execution data retention. 5) Apply least privilege to the credentials (scoped tokens, read-only DB users, IP allowlists on Atlas). 6) Detect misuse by reviewing Git host, MongoDB Atlas, and Google Cloud audit logs for access from unexpected IPs or by tokens used outside n8n.

What systems are affected by CVE-2026-118643?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, RAG pipelines, Vector databases, Workflow automation / orchestration, Cloud storage-backed data pipelines.

What is the CVSS score for CVE-2026-118643?

CVE-2026-118643 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.26%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksRAG pipelinesVector databasesWorkflow automation / orchestrationCloud storage-backed data pipelines

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0055Unsecured Credentials

AML.T0083Credentials from AI Agent Configuration

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data.

Exploitation Scenario

An attacker holds a low-privilege n8n account, such as a contractor or a compromised analyst, with permission to view workflow executions but not credentials. They find or trigger a failed run of a RAG ingestion workflow that uses the MongoDB Atlas Vector Store node, for example by supplying malformed input or relying on a transient outage. They open the execution's error data and read the plaintext database password or Google access token. They then connect directly to the vector database to exfiltrate or poison the embeddings that feed the company's AI agents, or use the Git token to read private repositories and push changes.

Weaknesses (CWE)

CWE-209Generation of Error Message Containing Sensitive InformationPrimary CWE-209Generation of Error Message Containing Sensitive Information

CWE-209 — Generation of Error Message Containing Sensitive Information: The product generates an error message that includes sensitive information about its environment, users, or associated data.

[Implementation] Ensure that error messages only contain minimal details that are useful to the intended audience and no one else. The messages need to strike the balance between being too cryptic (which can confuse users) or being too detailed (which may reveal more than intended). The messages should not reveal the methods that were used to determine the error. Attackers can use detailed information to refine or optimize their original attack, thereby increasing their chances of success. If errors must be captured in some detail, record them in log messages, but consider what could occur if the log messages can be viewed by attackers. Highly sensitive information such as passwords should never be saved to log files. Avoid inconsistent messaging that might accidentally tip off an attacker about internal state, such as whether a user account exists or not.
[Implementation] Handle exceptions internally and do not display errors containing potentially sensitive information to a user.

Source: MITRE CWE corpus.