CVE-2026-54307

CriticalCVSS 9.6/10Last modified Oct 25, 2026

Description

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential ownership checks were only enforced partially leading to cross-user credential access. This issue affects instances where workflow sharing is enabled and at least one workflow has been shared with a member-level user as an Editor. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
n8n-io	n8n	< 1.123.55; >= 2.0.0-rc.0, < 2.25.7; >= 2.26.0, < 2.26.2

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-pmqw-72cg-wx85Mitigation, Vendor Advisory

Timeline

Published: Jun 23, 2026
Last modified: Oct 25, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-543087.2n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, the MicrosoftAgent365Trigger and StripeTrigger node did not CVE-2026-5430910.0n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, when @n8n/mcp-browser is run in HTTP transport mode, the MCP CVE-2026-543109.9n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify wo CVE-2026-543117.7n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify wo CVE-2026-543128.5n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with permission to create or modify workflows cou CVE-2026-543137.7n8n is an open source workflow automation platform. Prior to 2.24.0, an authenticated user with workflow edit access could supply a maliciou CVE-2026-543147.5n8n is an open source workflow automation platform. Prior to 2.24.0, the Compression node's Decompress operation expanded attacker-controlle CVE-2026-543169.1Claude Code is an agentic coding tool. From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname f CVE-2026-543177.6Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.6.0, the Konnected integrati CVE-2026-543187.1Home Assistant is open source home automation software that puts local control and privacy first. Prior to 2026.5.3, the LocationSensorManag CVE-2026-543194.2Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.186, a sandbox volume CVE-2026-543208.4Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.184.0, organization i