CVE-2026-42227 is an authorization bypass vulnerability in the n8n workflow automation platform affecting versions prior to 1.123.32, 2.17.4, and 2.18.1. The flaw allows an authenticated user with a variable:list scoped API key to access variables from projects they are not members of by supplying an arbitrary projectId parameter to the public API variables endpoint. The root cause is that the handler bypassed the authorization-aware service layer and queried the variables repository directly without verifying project membership. This vulnerability only impacts licensed enterprise or team deployments with multiple projects and the variables feature enabled. The vulnerability has been addressed in the specified patched versions.

An authenticated user with limited API key permissions could access variables belonging to other projects, potentially exposing sensitive information such as credentials or tokens stored in those variables. This could lead to unauthorized disclosure of sensitive data within affected enterprise or team deployments. There is no indication of remote unauthenticated exploitation or privilege escalation beyond the scope of the API key. No known exploits in the wild have been reported.

This vulnerability has been patched in n8n versions 1.123.32, 2.17.4, and 2.18.1. Users of affected versions should upgrade to these or later versions to remediate the issue. Additionally, if sensitive information was stored in variables, such as credentials or tokens, those secrets should be rotated immediately. Since this issue only affects licensed enterprise or team deployments with multiple projects and the variables feature enabled, users outside this scope are not impacted.