CVE-2026-85171CWE-532

CVE-2026-85171

Medium · published September 3, 2026

CVSS v3.1
6.5
EPSS
1%
Percentile
46.1
In the wild
Unconfirmed
What it is

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00564 · 46.1th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-09-03T17:06Z
Affected products (3)
ProductVersionsFixed in
n8n/n8n< 1.123.731.123.73
n8n/n8n≥ 2.0.0, < 2.35.42.35.4
n8n/n8n≥ 2.36.0, < 2.36.22.36.2
References (2)
https://github.com/n8n-io/n8n/security/advisories/GHSA-vrv8-j27g-g7cr · [email protected]https://www.vulncheck.com/advisories/n8n-before-1.123.73-credential-exposure-via-error-logging · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:22Z
    n8n before 1.123.73 Credential Exposure via Error Logging
    cvelistv5