n8n Credential Exposure Vulnerability (CVE-2026-85171) — Medium Severity

Overview

The workflow automation tool n8n has a security vulnerability that could expose sensitive user credentials. This flaw affects specific nodes within the system, allowing authenticated users to accidentally uncover plaintext login information. This happens because certain nodes mishandle credentials during errors, storing them in a way that bypasses usual security measures.

CVE Details

  • Product: n8n
  • Published: September 3, 2026
  • Severity: Medium
  • Status: Analyzed

Affected Products

The vulnerability impacts n8n versions before 1.123.73, 2.35.4, and 2.36.2. Specifically, the Strapi, SeaTable, and Mailcheck nodes are involved in the credential exposure.

Current Status

This vulnerability has been officially analyzed. Patches are available to address the issue.

Severity Level

The vulnerability is rated as Medium severity with a CVSS score of 6.5. The potential impact is primarily on the confidentiality of user credentials, as an authenticated user could access these secrets if an error occurs during workflow execution with the affected nodes. While the GitHub advisory lists a CVSS v4 score of 7.1 (High), for this blog post, we are adhering to the “Medium” severity provided in the initial vulnerability data.

Possible Solutions

Developers and administrators using n8n are strongly advised to take immediate action to secure their instances:

  • Upgrade Immediately: The most effective solution is to upgrade your n8n instance to a patched version. This includes versions 1.123.73, 2.35.4, 2.36.2, or any later releases. These versions contain fixes that prevent credentials from being logged in plaintext.
  • Temporary Mitigations (if immediate upgrade is not possible):
    • Restrict Access: Limit access to your n8n instance to only highly trusted users. This reduces the number of individuals who could potentially exploit the vulnerability.
    • Disable Affected Nodes: You can disable the vulnerable nodes by adding their names to the NODES_EXCLUDE environment variable. The specific nodes to exclude are n8n-nodes-base.strapi, n8n-nodes-base.seaTable, and n8n-nodes-base.mailcheck.
    • Audit and Rotate Credentials: Review existing workflow execution logs for any unexpected credential values related to Strapi, SeaTable, and Mailcheck nodes. If any plaintext credentials are found, rotate them immediately and update your n8n credentials after patching.

It’s important to remember that the temporary mitigations only reduce the risk and do not fully resolve the vulnerability. Upgrading to a patched version is the recommended long-term solution.

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-vrv8-j27g-g7cr

https://www.vulncheck.com/advisories/n8n-before-1.123.73-credential-exposure-via-error-logging

Suggested Internal Backlinks:

  • Understanding CVSS Scores: A Guide to Vulnerability Severity
  • Best Practices for Securing Workflow Automation Tools
  • Protecting Sensitive Data: A Comprehensive Security Guide
Tags
Alex Joseph
Alex Joseph

Alex Joseph is a Senior Support Staff professional with deep experience in server management, web hosting technologies, and cybersecurity operations. He works daily with Linux servers, cloud platforms, performance tuning, and security hardening, giving him strong real-world technical knowledge. Along with his support role, he write about security best practices, hosting infrastructure, and software management.

Related Posts