PT-2026-36898 · N8N · N8N

Espanda666 · Published 2026-04-21 · Updated 2026-05-05 · CVE-2026-42226

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.33 n8n versions prior to 2.17.5

Description An issue in the 'dynamic-node-parameters' endpoints allows an authenticated user with access to a shared workflow to supply a foreign credential ID in the request body. Because the system fails to verify if the caller is authorized to use the supplied credential reference, the backend decrypts and uses that credential in a helper execution path where the caller also controls the destination URL. This enables the caller to force the backend to authenticate against attacker-controlled infrastructure using a credential belonging to another user, leading to the exfiltration of reusable API keys. This issue affects any node that resolves credentials dynamically through these endpoints.

Recommendations Update to version 1.123.33 or newer. Update to version 2.17.5 or newer.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2026-06920

CVE-2026-42226

GHSA-R4V6-9FQC-W5JR

Affected Products

N8N

References · 10

• https://github.com/n8n-io/n8n/security/advisories/GHSA-r4v6-9fqc-w5jr · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42226 · Security Note
• https://bdu.fstec.ru/vul/2026-06920 · Security Note
• https://osv.dev/vulnerability/GHSA-r4v6-9fqc-w5jr · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://twitter.com/CVEnew/status/2051383979073245424 · Twitter Post
• https://security.snyk.io/vuln/SNYK-JS-N8N-16353556 · Note
• https://twitter.com/infoflowcloud/status/2051385424363376694 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2051544445728776378 · Twitter Post
• https://t.me/cveNotify/162075 · Telegram Post