n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…io/n8n/security/advisories/GHSA-crfj-5wv6-8v86 Üretici bülteni
• vulncheck.com/…-trigger-api-token-exposure-via-execution-data Üçüncü taraf

Kayıt geçmişi

1. 28 Eki 2026 21:59Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-118679n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger
• 7,1 CVE-2026-118678n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
• 7,1 CVE-2026-118676n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
• 5,9 CVE-2026-118677n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance
• 7,1 CVE-2026-118675n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
• 8,3 CVE-2026-118649n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables