Threats tagged 'ghsa-cfc8-9wgc-86cf'

n8n versions before 2.41.5 and 2.42.x before 2.42.2 have a vulnerability where a failed workflow's full execution context, including the identity of the user who started the run, is passed to the configured error workflow. This allows a project editor to manipulate a colleague's workflow error settings to inherit their identity upon workflow failure and access their per-user dynamic credential secrets.