N8n Before 2.43.5 And 2.44.1 Authorization Bypass Via Crafted Workflow Id In Data Tables

Back www.vulncheck.com

N8n Before 2.43.5 And 2.44.1 Authorization Bypass Via Crafted Workflow Id In Data Tables

www.vulncheck.com • October 29, 2026

Share: View original

n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

n8n >= 2.44.0, = 2.44.0, < 2.44.1

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

GitHub Security Advisory (GHSA-wvjj-qg37-pv73)

Ready to get Started?

Vulnerability Prioritization Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.

Early Warning System Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Multiple Vulnerabilities in n8n Affecting Versions Before 2.44.1 A series of vulnerabilities have been identified in n8n versions prior to 2.44.1, including an authorization bypass, credential exposure, and sensitive data leakage. The affected versions range from 1.123.85 to 2.44.1. Specific issues include an authorization bypass via crafted workflow IDs (CWE-1321), credential exposure through node execution errors (CWE-209), and API token exposure via execution data (CWE-532). Additionally, there are vulnerabilities related to credential guard bypass (CWE-863) and credential theft via error workflow context inheritance (CWE-266). These vulnerabilities could allow unauthorized access and data leakage. Users are advised to update to the latest versions to mitigate these risks. No has been reported as of now. 46

Extracted Entities

CWE Weaknesses (1)

CWE-1321 - Prototype Pollution

Vulnerabilities (1)

Prototype Pollution