n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.

Etkilenen sürümler1 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…io/n8n/security/advisories/GHSA-wvjj-qg37-pv73 Üretici bülteni
• vulncheck.com/…-bypass-via-crafted-workflow-id-in-data-tables Üçüncü taraf

Kayıt geçmişi

1. 28 Eki 2026 21:59Yayımlandı

İlgili açıklar

• 7,5 CVE-2026-118679n8n before 1.123.83, 2.41.4, and 2.42.1 Slack Token Exfiltration via Slack Trigger
• 7,1 CVE-2026-118678n8n before 2.41.4 and 2.42.1 Prototype Pollution DoS via Workflow History Compaction
• 7,1 CVE-2026-118676n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass
• 5,9 CVE-2026-118677n8n before 2.41.4 and 2.42.1 Local Gateway Deep-Link Silent Re-pairing to Attacker Instance
• 7,1 CVE-2026-118675n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow
• 8,2 CVE-2026-118647n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data