AI Threat AlertCVE-2026-118644: n8n: error workflow inherits user identity, steals creds
HIGHn8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can point a colleague's workflow at an error workflow they own, inherit the colleague's identity when it fails, and resolve that colleague's per-user dynamic credential secrets. This matters most where n8n orchestrates AI agents with access to LLM API keys, databases and SaaS tokens, because a low-privilege insider can turn a failure into credential theft with changed scope. Exploitation needs high complexity and user interaction, and there is no public exploit, Nuclei template, KEV listing or EPSS data, so the near-term likelihood is moderate. Upgrade to 2.41.5 or 2.42.2, audit workflows for unexpected errorWorkflow settings, and rotate credentials that were exposed to shared projects.
What is the risk?
High (CVSS 7.7). The attack is network-reachable and needs only low privileges (project editor), but it also needs a victim workflow to fail and some user interaction, and the complexity is high. The changed scope and high confidentiality and integrity impact come from the attacker acting with the victim's identity and reaching credentials the attacker was never granted. There are no known exploits, KEV listing or SSVC decision, so the likelihood is moderate. The main exposure is in multi-user n8n instances where editors share projects and workflows use per-user dynamic credentials.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
6 stepsUpgrade n8n to 2.41.5 or later, or to 2.42.2 or later on the 2.42.x line.
Until patched, limit project editor rights and restrict who can change workflow settings.
Audit all workflows for settings.errorWorkflow values that point to workflows owned by other users, and review recent changes to those settings.
Review the execution logs of error workflows for access to credentials belonging to users other than the error workflow's owner.
Rotate per-user dynamic credentials and API keys that may have been exposed, especially in shared projects.
Prefer scoped, least-privilege credentials for AI agent workflows and monitor downstream API use for anomalies.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-118644?
n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can point a colleague's workflow at an error workflow they own, inherit the colleague's identity when it fails, and resolve that colleague's per-user dynamic credential secrets. This matters most where n8n orchestrates AI agents with access to LLM API keys, databases and SaaS tokens, because a low-privilege insider can turn a failure into credential theft with changed scope. Exploitation needs high complexity and user interaction, and there is no public exploit, Nuclei template, KEV listing or EPSS data, so the near-term likelihood is moderate. Upgrade to 2.41.5 or 2.42.2, audit workflows for unexpected errorWorkflow settings, and rotate credentials that were exposed to shared projects.
Is CVE-2026-118644 actively exploited?
No confirmed active exploitation of CVE-2026-118644 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-118644?
1. Upgrade n8n to 2.41.5 or later, or to 2.42.2 or later on the 2.42.x line. 2. Until patched, limit project editor rights and restrict who can change workflow settings. 3. Audit all workflows for settings.errorWorkflow values that point to workflows owned by other users, and review recent changes to those settings. 4. Review the execution logs of error workflows for access to credentials belonging to users other than the error workflow's owner. 5. Rotate per-user dynamic credentials and API keys that may have been exposed, especially in shared projects. 6. Prefer scoped, least-privilege credentials for AI agent workflows and monitor downstream API use for anomalies.
What systems are affected by CVE-2026-118644?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines, multi-tenant AI automation.
What is the CVSS score for CVE-2026-118644?
CVE-2026-118644 has a CVSS v3.1 base score of 7.7 (HIGH). The EPSS exploitation probability is 0.20%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0081Modify AI Agent ConfigurationAML.T0083Credentials from AI Agent ConfigurationAML.T0098AI Agent Tool Credential HarvestingCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.
Exploitation Scenario
A malicious or compromised project editor in a shared n8n instance sets the errorWorkflow of a colleague's AI agent workflow to an error workflow the editor owns. When the colleague's workflow next fails, or is made to fail, n8n sends the full execution context, including the colleague's identity, to the attacker's error workflow. That workflow runs as the colleague and resolves their per-user dynamic credentials, such as LLM API keys and CRM or database tokens. The attacker exfiltrates the secrets and uses them to reach systems outside their own permissions.
Weaknesses (CWE)
CWE-266 — Incorrect Privilege Assignment: A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor.
- [Architecture and Design, Operation] Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- [Architecture and Design, Operation] Run your code using the lowest privileges that are required to accomplish the necessary tasks [REF-76]. If possible, create isolated accounts with limited privileges that are only used for a single task. That way, a successful attack will not immediately give the attacker access to the rest of the software or its environment. For example, database applications rarely need to run as the database administrator, especially in day-to-day operations.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n