AI Threat AlertCVE-2026-85171: n8n: plaintext credential leak via error logging
HIGHn8n's Strapi, SeaTable, and Mailcheck nodes send decrypted credentials through a legacy HTTP helper that skips the platform's error-handling wrapper, so when those requests fail the plaintext secret gets written into the execution's error data instead of being redacted. Any authenticated user — not just admins — can then pull that plaintext secret out of their own execution via n8n's REST API, completely bypassing the blank-value redaction the credentials API is supposed to enforce. There's no CVSS score, EPSS data, KEV listing, or public exploit yet, but this is a workflow orchestration platform with 211 other tracked CVEs and a 6.7/10 OpenSSF score, and any org running multi-tenant n8n instances with shared Strapi, SeaTable, or Mailcheck integrations is exposed to insider credential theft with essentially no skill required. Patch to n8n 1.123.73, 2.35.4, or 2.36.2 immediately, and in the meantime rotate any Strapi, SeaTable, or Mailcheck credentials used in shared or multi-user n8n instances and audit execution history for exposed secrets.
What is the risk?
Low-to-moderate severity in absolute terms — this is not remote, unauthenticated, or wormable — but the exploitability bar is essentially zero for anyone who already holds any authenticated account on a shared or multi-tenant n8n instance: no exploit code, scanner template, or CVSS/EPSS score exists yet, but the technique requires nothing beyond triggering a normal API error and reading one's own execution history. The real risk driver is blast radius and trust model: n8n is increasingly used as an AI agent orchestration layer wiring together third-party services, so the 'credentials' at stake are often shared service accounts rather than per-user secrets — meaning one low-privilege user can pivot into systems (CMS, database, email verification) that were never meant to be accessible to them. Absence from CISA KEV and lack of a public PoC keep urgency moderate rather than critical, but any org with self-hosted, multi-tenant n8n should treat this as a near-term patch item rather than a backlog item.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 stepUpgrade to n8n 1.123.73, 2.35.4, or 2.36.2, which fix the raw legacy HTTP helper path for the Strapi, SeaTable, and Mailcheck nodes. Until patched, restrict or disable these three node types in shared/multi-tenant instances, and treat any credential ever used in a Strapi/SeaTable/Mailcheck node as potentially exposed — rotate them proactively. Audit execution history and REST API access logs for calls that retrieved error data from executions using these nodes, since that is the exfiltration path. Longer term, enforce least-privilege execution visibility (users should only see executions they own or are explicitly granted) and monitor for anomalous REST API polling of execution error payloads.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-85171?
n8n's Strapi, SeaTable, and Mailcheck nodes send decrypted credentials through a legacy HTTP helper that skips the platform's error-handling wrapper, so when those requests fail the plaintext secret gets written into the execution's error data instead of being redacted. Any authenticated user — not just admins — can then pull that plaintext secret out of their own execution via n8n's REST API, completely bypassing the blank-value redaction the credentials API is supposed to enforce. There's no CVSS score, EPSS data, KEV listing, or public exploit yet, but this is a workflow orchestration platform with 211 other tracked CVEs and a 6.7/10 OpenSSF score, and any org running multi-tenant n8n instances with shared Strapi, SeaTable, or Mailcheck integrations is exposed to insider credential theft with essentially no skill required. Patch to n8n 1.123.73, 2.35.4, or 2.36.2 immediately, and in the meantime rotate any Strapi, SeaTable, or Mailcheck credentials used in shared or multi-user n8n instances and audit execution history for exposed secrets.
Is CVE-2026-85171 actively exploited?
No confirmed active exploitation of CVE-2026-85171 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-85171?
Upgrade to n8n 1.123.73, 2.35.4, or 2.36.2, which fix the raw legacy HTTP helper path for the Strapi, SeaTable, and Mailcheck nodes. Until patched, restrict or disable these three node types in shared/multi-tenant instances, and treat any credential ever used in a Strapi/SeaTable/Mailcheck node as potentially exposed — rotate them proactively. Audit execution history and REST API access logs for calls that retrieved error data from executions using these nodes, since that is the exfiltration path. Longer term, enforce least-privilege execution visibility (users should only see executions they own or are explicitly granted) and monitor for anomalous REST API polling of execution error payloads.
What systems are affected by CVE-2026-85171?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines, third-party plugin/tool integrations.
What is the CVSS score for CVE-2026-85171?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0055Unsecured CredentialsAML.T0091Use Alternate Authentication MaterialAML.T0098AI Agent Tool Credential HarvestingCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.
Exploitation Scenario
An organization runs a shared n8n instance where multiple teams build automations, and one workflow uses a Strapi node with an admin-level API credential to publish content. A low-privilege team member with only workflow-creation access sets up a test workflow using that same Strapi credential (or one shared across the org) and intentionally sends a malformed request — an invalid endpoint or bad payload — causing the Strapi node to error. Because the raw legacy HTTP helper bypasses error handling, the decrypted API secret gets written into that execution's error data in the database. The user then calls n8n's REST API to fetch their own execution details, retrieves the plaintext Strapi credential despite having no direct access to the credential object, and uses it to authenticate directly against the Strapi CMS — gaining content-management access far beyond their intended n8n permissions.
Weaknesses (CWE)
CWE-532Insertion of Sensitive Information into Log FileCWE-532Insertion of Sensitive Information into Log FileCWE-532 — Insertion of Sensitive Information into Log File: The product writes sensitive information to a log file.
- [Architecture and Design, Implementation] Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
- [Distribution] Remove debug log files before deploying the application into production.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274959.9n8n: Code Injection enables RCE
Same package: n8n