Description
n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.
Published: 2026-09-03
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Credential Exposure
Action: Apply Patch
AI Analysis

Impact

n8n versions prior to 1.123.73, 2.35.4, and 2.36.2 contain a flaw in the Strapi, SeaTable, and Mailcheck nodes that send decrypted credentials to the authentication endpoint using a raw legacy HTTP helper without error handling. The plaintext secret is persisted in execution error data, and any authenticated user can retrieve it via the REST API, bypassing the blank-value redaction enforced by the credentials API.

Affected Systems

The vulnerability affects n8n version 1.123.72 and earlier, 2.35.4, and 2.36.2. The affected components are the Strapi, SeaTable, and Mailcheck nodes within those releases.

Risk and Exploitability

The CVSS score is 7.1, the EPSS score is not available, and the vulnerability is not listed in CISA KEV. The likely attack vector involves an authenticated user accessing their own execution logs through the REST API. Exploitation requires that the user has legitimate credentials to n8n and that the application’s error data is accessible via the API.

Generated by OpenCVE AI on September 3, 2026 at 13:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade n8n to version 1.123.73 or newer, or to 2.35.5 or newer, which removes the logging of decrypted credentials.
  • If an upgrade is not immediately possible, configure the nodes to disable error logging for sensitive data or remove the raw legacy HTTP helper that transmits the secrets.
  • After patching or configuration changes, review execution logs for any residual plaintext credentials and rotate affected secrets to ensure no data remains exposed.

Generated by OpenCVE AI on September 3, 2026 at 13:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 16 Sep 2026 21:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Thu, 03 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.
Title n8n before 1.123.73 Credential Exposure via Error Logging
First Time appeared N8n
N8n n8n
Weaknesses CWE-532
CPEs cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
Vendors & Products N8n
N8n n8n
References
Metrics cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}

Subscriptions

N8n N8n
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-03T14:30:11.030Z

Reserved: 2026-09-03T11:05:09.078Z

Link: CVE-2026-85171

cve-icon Vulnrichment

Updated: 2026-09-03T14:05:18.905Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-03T13:06:24.703

Modified: 2026-09-16T21:38:07.557

Link: CVE-2026-85171

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T15:30:05Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File