PT-2026-40937 · N8N · N8N

Published 2026-05-14 · Updated 2026-05-14 · CVE-2026-45732

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.43 n8n versions prior to 2.20.7 n8n versions prior to 2.21.1

Description An authorization bypass exists in the OAuth1 and OAuth2 credential reconnect endpoints. These endpoints incorrectly authorized access using credential:read instead of credential:update. An authenticated user with read-only access to a shared credential could initiate an OAuth reconnect flow to overwrite stored token material with tokens from an external account they control. This allows workflows using the affected credential to execute under the attacker's OAuth identity, potentially leading to data exfiltration to external services and persistent takeover of shared integrations. This issue specifically affects instances where credentials are shared across projects or with other users.

Recommendations Update to version 1.123.43 or later. Update to version 2.20.7 or later. Update to version 2.21.1 or later. Restrict credential sharing to fully trusted users only. Audit shared credentials for unexpected OAuth token changes and revoke any tokens that may have been replaced.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-45732

GHSA-6H4J-WCR9-2VG7

Affected Products

N8N

References · 5

• https://osv.dev/vulnerability/GHSA-6h4j-wcr9-2vg7 · Vendor Advisory
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/security/advisories/GHSA-6h4j-wcr9-2vg7 · Note
• https://twitter.com/UpwindMDR/status/2054876407382036673 · Twitter Post
• https://twitter.com/dailycve/status/2054988731719774286 · Twitter Post