AI Threat AlertCVE-2026-118647: n8n: SeaTable Trigger leaks API token in executions
HIGHA flaw in n8n's SeaTable Trigger node writes the node's API token in plaintext into failed-execution data, so anyone who can view workflow executions can recover the credential even if they are not allowed to read it directly. This breaks n8n's credential separation, and the stolen token gives full read/write access to the connected SeaTable base (CVSS 8.2 with scope change, high confidentiality and integrity impact). The risk is bounded: it needs an authenticated low-privilege user and a failed poll to occur, there is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, so this is an insider or lateral-movement problem rather than an internet-wide mass-exploitation one. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 or later, rotate every SeaTable API token used in affected workflows, and purge or restrict historical execution data that may already contain the token.
What is the risk?
High severity but moderate practical likelihood. Exploitation requires network access, low privileges (permission to view executions) and a failed SeaTable poll that stores raw request headers (AC:H). No public exploit, no Nuclei template, not in CISA KEV, and EPSS is unavailable, so there is no evidence of active exploitation. The scope change matters: the exposed token grants access to an external SeaTable base outside n8n's own security boundary, with high confidentiality and integrity impact. Risk is highest in multi-user n8n instances where execution visibility is broader than credential access, such as shared automation platforms with agent workflows that feed data into SeaTable.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade n8n to 1.123.85 or later on the 1.x line, 2.43.5 or later on 2.x, or 2.44.1 or later on 2.44.x. 2) Rotate all SeaTable API tokens used by SeaTable Trigger nodes, assuming they may already be exposed. 3) Delete or prune existing error execution data for affected workflows, including copies in database backups and exported logs. 4) Restrict execution-view permissions to those who need them and enforce least privilege on projects and roles. 5) Detection: search execution data and logs for SeaTable authorization headers, and review SeaTable audit logs for API access from unexpected IPs or user agents. 6) Where patching is delayed, disable or pause SeaTable Trigger workflows, or configure execution data not to be saved on error.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-118647?
A flaw in n8n's SeaTable Trigger node writes the node's API token in plaintext into failed-execution data, so anyone who can view workflow executions can recover the credential even if they are not allowed to read it directly. This breaks n8n's credential separation, and the stolen token gives full read/write access to the connected SeaTable base (CVSS 8.2 with scope change, high confidentiality and integrity impact). The risk is bounded: it needs an authenticated low-privilege user and a failed poll to occur, there is no public exploit, no Nuclei template, no KEV listing and no EPSS score yet, so this is an insider or lateral-movement problem rather than an internet-wide mass-exploitation one. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 or later, rotate every SeaTable API token used in affected workflows, and purge or restrict historical execution data that may already contain the token.
Is CVE-2026-118647 actively exploited?
No confirmed active exploitation of CVE-2026-118647 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-118647?
1) Upgrade n8n to 1.123.85 or later on the 1.x line, 2.43.5 or later on 2.x, or 2.44.1 or later on 2.44.x. 2) Rotate all SeaTable API tokens used by SeaTable Trigger nodes, assuming they may already be exposed. 3) Delete or prune existing error execution data for affected workflows, including copies in database backups and exported logs. 4) Restrict execution-view permissions to those who need them and enforce least privilege on projects and roles. 5) Detection: search execution data and logs for SeaTable authorization headers, and review SeaTable audit logs for API access from unexpected IPs or user agents. 6) Where patching is delayed, disable or pause SeaTable Trigger workflows, or configure execution data not to be saved on error.
What systems are affected by CVE-2026-118647?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, RAG pipelines, data ingestion pipelines.
What is the CVSS score for CVE-2026-118647?
CVE-2026-118647 has a CVSS v3.1 base score of 8.2 (HIGH). The EPSS exploitation probability is 0.26%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0055Unsecured CredentialsAML.T0083Credentials from AI Agent ConfigurationAML.T0091.000Application Access TokenAML.T0098AI Agent Tool Credential HarvestingCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.
Exploitation Scenario
An attacker with a low-privilege n8n account, such as a contractor or compromised analyst account, has permission to view workflow executions but not credentials. They open a failed execution of a workflow whose SeaTable Trigger poll errored and read the stored request headers, which contain the SeaTable API token. They then call the SeaTable API directly from outside n8n to read sensitive tables that feed an AI agent or RAG pipeline, and write malicious or manipulated records that downstream AI workflows later consume, enabling data theft and integrity attacks against automated decisions.
Weaknesses (CWE)
CWE-532Insertion of Sensitive Information into Log FilePrimaryCWE-532Insertion of Sensitive Information into Log FileCWE-532 — Insertion of Sensitive Information into Log File: The product writes sensitive information to a log file.
- [Architecture and Design, Implementation] Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- [Distribution] Remove debug log files before deploying the application into production.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n