CVE-2026-54305: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in n8n-io n8n
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature accepted any authenticated n8n session without performing per-resource ownership or scope checks on the target workflow or credential. An authenticated user with no project membership or credential sharing relationship could enumerate credential identifiers, names, and types referenced by any private workflow in the instance, initiate an OAuth authorization flow against another user's credential to overwrite its stored tokens with tokens bound to an account they control, or revoke another user's stored credential tokens entirely. Workflows relying on a hijacked credential would subsequently execute under the attacker's OAuth identity, enabling data exfiltration to attacker-controlled external services and persistent takeover of integrations. Token revocation would break affected workflows. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.
AI Analysis
Technical Summary
CVE-2026-54305 affects the n8n workflow automation platform in versions prior to 1.123.55, 2.25.7, and 2.26.2. Three Enterprise Edition endpoints used by the Dynamic Credentials feature improperly accept any authenticated session without performing per-resource ownership or scope checks. This flaw allows an authenticated user without project membership or credential sharing to enumerate credential identifiers, names, and types from private workflows, initiate OAuth authorization flows to overwrite stored tokens with attacker-controlled tokens, or revoke other users' credential tokens. As a result, attackers can cause workflows to execute under their OAuth identity, enabling data exfiltration and persistent integration takeover. Token revocation can also disrupt legitimate workflows. The issue is addressed in the specified fixed versions.
Potential Impact
An attacker with any authenticated n8n session can enumerate sensitive credential information from private workflows, hijack OAuth tokens to execute workflows under their identity, and revoke tokens to disrupt workflows. This leads to exposure of sensitive information, unauthorized data exfiltration, persistent takeover of integrations, and potential denial of service for affected workflows.
Mitigation Recommendations
This vulnerability is fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to at least these versions to remediate the issue. No other mitigation or temporary workaround is indicated in the available data.
CVE-2026-54305: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in n8n-io n8n
Description
n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature accepted any authenticated n8n session without performing per-resource ownership or scope checks on the target workflow or credential. An authenticated user with no project membership or credential sharing relationship could enumerate credential identifiers, names, and types referenced by any private workflow in the instance, initiate an OAuth authorization flow against another user's credential to overwrite its stored tokens with tokens bound to an account they control, or revoke another user's stored credential tokens entirely. Workflows relying on a hijacked credential would subsequently execute under the attacker's OAuth identity, enabling data exfiltration to attacker-controlled external services and persistent takeover of integrations. Token revocation would break affected workflows. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.
CVSS v4.0
Score 8.9high
Affected software
pkg:github/n8n-io/n8nRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-54305 affects the n8n workflow automation platform in versions prior to 1.123.55, 2.25.7, and 2.26.2. Three Enterprise Edition endpoints used by the Dynamic Credentials feature improperly accept any authenticated session without performing per-resource ownership or scope checks. This flaw allows an authenticated user without project membership or credential sharing to enumerate credential identifiers, names, and types from private workflows, initiate OAuth authorization flows to overwrite stored tokens with attacker-controlled tokens, or revoke other users' credential tokens. As a result, attackers can cause workflows to execute under their OAuth identity, enabling data exfiltration and persistent integration takeover. Token revocation can also disrupt legitimate workflows. The issue is addressed in the specified fixed versions.
Potential Impact
An attacker with any authenticated n8n session can enumerate sensitive credential information from private workflows, hijack OAuth tokens to execute workflows under their identity, and revoke tokens to disrupt workflows. This leads to exposure of sensitive information, unauthorized data exfiltration, persistent takeover of integrations, and potential denial of service for affected workflows.
Mitigation Recommendations
This vulnerability is fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to at least these versions to remediate the issue. No other mitigation or temporary workaround is indicated in the available data.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-12T17:46:37.294Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3ab6d9eed863c81e4f9ea9
Added to database: 06/23/2026, 16:39:53 UTC
Last enriched: 06/23/2026, 16:54:37 UTC
Last updated: 06/23/2026, 18:09:40 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.