CVE-2026-85171

6.5 Moyenne

Publiée le 03/09/2026 à 15:06 · Modifiée le 16/09/2026 à 23:38 · Analysée par le NVD · Source : disclosure@vulncheck.com

Description

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

Traduire en français

Produits concernés

Scores CVSS

Version	Score	Source	Vecteur
4.0	7.1 Élevée	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	6.5 Moyenne	nvd@nist.gov (NVD)	`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`

Faiblesses (CWE)

CWE-532

Références

https://github.com/n8n-io/n8n/security/advisories/GHSA-vrv8-j27g-g7cr MitigationVendor Advisory
https://www.vulncheck.com/advisories/n8n-before-1.123.73-credential-exposure-via-error-logging Third Party Advisory

CVE-2026-85171

Description

Produits concernés

Scores CVSS

Faiblesses (CWE)

Références

Ailleurs