Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
n8n is an open source workflow automation platform. Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify whether the authenticated caller was authorized to use a supplied credential reference. An authenticated user with access to a shared workflow could supply a foreign credential ID in the request body, causing the backend to decrypt and use that credential in a helper execution path where the caller also controls the destination URL. This allowed the caller to force the backend to authenticate against attacker-controlled infrastructure using a credential belonging to another user, effectively exfiltrating a reusable API key. The issue is not limited to any single node type; any node that resolves credentials dynamically through these endpoints may be affected. This issue has been patched in versions 1.123.33, 2.17.5, and 2.18.0.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-04 | 2 | Disclosure1Patch1 |
| 2026-05-05 | 1 | Disclosure1 |
CVE-2026-42226 Credential Exfiltration in n8n Workflow Automation Platform Prior to 1.123.33 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42226
Post summary
The CVE-2026-42226 disclosure describes credential exfiltration in n8n Workflow Automation Platform before version 1.123.33, but provides no PoC, exploit code, active exploitation evidence, or patch details.
🚨*CVE* CVE-2026-42226 n8n is an open source workflow automation platform. Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify whether the authentica… https://www.cve.org/CVERecord?id=CVE-2026-42226 ----- Traducción: CVE-2026-42226 n8n… http://infoflow.cloud`
Post summary
CVE‑2026‑42226 impacts n8n’s dynamic‑node‑parameters endpoints by failing to verify authentication before versions 1.123.33 and 2.17.5, with the issue addressed in later releases.
CVE-2026-42226 n8n is an open source workflow automation platform. Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify whether the authentica… https://www.cve.org/CVERecord?id=CVE-2026-42226
Post summary
CVE-2026-42226 impacts the dynamic-node-parameters endpoints in n8n, and the vulnerability is addressed in versions 1.123.33 and 2.17.5.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | n8n | n8n | - | node.js | - |