GHSA-cfc8-9wgc-86cfMediumCVSS 7.7

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context,...

Published
October 28, 2026
Last Modified
October 28, 2026

🔗 CVE IDs covered (1)

📋 Description

n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.

🔗 References (4)