CVE-2026-85171

MediumCVSS 6.5/10Last modified Sep 16, 2026

Description

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-532

Affected software

No affected versions have been published.

Timeline

Published
Sep 3, 2026
Last modified
Sep 16, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-851726.4n8n versions before 2.34.1 contain a server-side request forgery vulnerability in the legacy request helper function exposed to Code and FunCVE-2026-851734.3n8n versions before 2.36.2 contain a missing per-project authorization vulnerability in the Insights API routes that allows authenticated usCVE-2026-851748.8SiYuan before v3.8.2 logs API tokens from query parameters in plaintext to an accessible log file when full-text search requests exceed timiCVE-2026-851758.8SiYuan versions <= 3.8.1 (fixed in v3.8.2) contain an incomplete blocklist in the IsForbiddenAbsPath() function (kernel/util/path_guard.go),CVE-2026-851768.8DbGate fails to validate jslid parameters in the jsldata controller, allowing authenticated users to read and write arbitrary files via fileCVE-2026-851775.4CRMEB through 6.0.0 fails to validate message ownership in the edit_message handler of MessageSystemController.php, allowing authenticated uCVE-2026-851787.7Helicone's VaultManager.getDecryptedProviderKeyById() function in the GET /v1/vault/key/{providerKeyId} endpoint fails to validate the requeCVE-2026-851798.5Label Studio through 1.23.0 fails to validate webhook URLs, allowing authenticated users to dispatch requests to internal services includingCVE-2026-85188.8Use after free in Blink in Google Chrome prior to 148.0.7778.168 allowed a remote attacker to execute arbitrary code inside a sandbox via a CVE-2026-851807.5Ollama fails to validate redirect destinations when pulling tensor-layer models, allowing unauthenticated attackers to redirect blob downloaCVE-2026-851819.8CAT uses Java String.hashCode as the sole integrity check for session cookies without server-side keying, allowing attackers to forge valid CVE-2026-851827.5vhr through commit 03abbd3 fails to verify that the account ID in PUT /hr/pass requests belongs to the authenticated caller. Authenticated a