n8n, a popular open-source platform for workflow automation, has addressed a significant security flaw. This vulnerability, identified as CVE-2026-45732, could allow an authenticated user with limited permissions to gain control over shared connections, potentially leading to data theft and persistent unauthorized access to integrated services. It’s crucial for users and administrators to understand this risk and apply the necessary updates.
CVE Details
This vulnerability impacts the n8n workflow automation platform.
- Product: n8n
- CVE ID: CVE-2026-45732
- Published Date: June 23, 2026
- Severity: High
Affected Products
The vulnerability exists in n8n versions prior to 1.123.43, 2.21.1, and 2.20.7.
Specifically, if you are running any n8n instance that has not been updated to at least these versions, you are at risk. The flaw affects both OAuth1 and OAuth2 credential reconnect endpoints.
Current Status
The vulnerability has been thoroughly analyzed, and the n8n development team has released patches to address the issue. Users are strongly advised to update their installations as soon as possible to mitigate the risk.
Severity Level
Rated as High severity with a CVSS v4 score of 8.3, this flaw presents a substantial risk. The core problem lies in an authorization bypass where `credential:read` permissions were mistakenly used instead of `credential:update` for OAuth credential reconnect endpoints. This misconfiguration allows an attacker with read-only access to a shared credential to trick the system during an OAuth reconnect. They can then replace the legitimate tokens with their own, effectively hijacking shared integrations. This enables malicious activities such as unauthorized data exfiltration to external services controlled by the attacker, and a persistent takeover of any workflows dependent on that compromised credential.
Possible Solutions
The most effective way to secure your n8n instance against CVE-2026-45732 is to update to a patched version immediately.
- Upgrade: Update your n8n installation to version 1.123.43, 2.21.1, 2.20.7, or any later versions that address this security issue.
If immediate upgrading is not feasible, consider these temporary mitigation steps:
- Restrict Sharing: Limit sharing of credentials exclusively to users you fully trust.
- Audit Credentials: Regularly review and audit shared credentials for any unexpected changes in OAuth tokens. If any anomalies are found, revoke those tokens immediately.
Remember, these workarounds offer only partial protection and should only be used as a short-term measure until you can apply the full security update.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-6h4j-wcr9-2vg7
