Understanding the n8n Information Disclosure Vulnerability
A recently discovered security flaw in the n8n workflow automation platform could allow unauthorized access to sensitive information. This vulnerability, tracked as CVE-2026-42227, affects specific enterprise and team deployments of n8n. In simple terms, an authenticated user with certain API access could potentially view private variables from projects they are not supposed to be part of. This is concerning because these variables might hold critical data like credentials or tokens.
CVE Details
- Product: n8n (specifically Enterprise or Team deployments with multiple projects and the variables feature enabled)
- Published: May 4, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The vulnerability impacts n8n versions prior to 1.123.32, 2.17.4, and 2.18.1. This issue is relevant only for licensed enterprise or team deployments of n8n that use multiple projects and have the variables feature enabled. Standard n8n installations or those not utilizing these specific enterprise features are not affected.
Current Status
This vulnerability has been thoroughly analyzed. The n8n team has released patches to address the issue, and users are strongly advised to update their installations.
Severity Level
Rated as Medium severity with a CVSS score of 6.5, this vulnerability could lead to a significant information leak if exploited. While an attacker needs to be an authenticated user with a specific API key, the ability to bypass project membership checks to access sensitive variables poses a notable risk to data confidentiality.
Possible Solutions
The most effective way to secure your n8n installation against CVE-2026-42227 is to upgrade to a patched version immediately. The following versions include the fix:
- n8n version 1.123.32 or later
- n8n version 2.17.4 or later
- n8n version 2.18.1 or later
If an immediate upgrade isn’t feasible, here are some temporary mitigation steps:
- Rotate Sensitive Variables: If any sensitive information like credentials or tokens were stored in n8n variables, these should be rotated or invalidated immediately as they may have been exposed.
- Restrict API Key Access: Limit the issuance of API keys and n8n access to only fully trusted users.
These workarounds are temporary and do not fully eliminate the risk. Prioritizing the upgrade to a patched version is highly recommended.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-756q-gq9h-fp22
