CVE-2026-110850 n8n-io CVE debrief

Who should care

Defenders responsible for n8n workflows, especially those using Agent nodes, shared workflows, or inline mode configurations, should assess exposure and prioritize updates to versions 2.41.4 or 2.42.1.

Why it matters

Defenders should prioritize verifying exposure in n8n workflows using Agent nodes, especially those with shared workflows or inline mode configurations, and assess the need for updates to versions 2.41.4 or 2.42.1. The vulnerability allows an editor to bypass credential checks, potentially leading to unauthorized access to sensitive credentials and workflows, data breaches, and lateral movement within the network. Verification of n8n version and configuration is necessary to determine exposure.

• Potential unauthorized access to sensitive credentials and workflows.
• Possible data breaches due to decrypted secrets being sent to an attacker-chosen destination.
• Compromised n8n workflows could lead to lateral movement within the network.
• Verification of n8n version and configuration is necessary to determine exposure.

Technical summary

The n8n workflow automation tool has a vulnerability in versions before 2.41.4 and 2.42.1, where an editor can bypass credential checks via Agent node parameters. This allows an editor to configure a Message an Agent node in inline mode with tools they control to resolve the owner's credentials and send decrypted secrets to an attacker-chosen destination. The vulnerability is due to the lack of validation of credential IDs stored in agent node parameters when an editor saves a shared workflow. This can lead to potential security risks, including unauthorized access to sensitive credentials and workflows, data breaches, and lateral movement within the network. Defenders should prioritize verifying exposure in n8

Defensive priority

Defenders should prioritize verifying exposure in n8n workflows using Agent nodes, especially those with shared workflows or inline mode configurations, and assess the need for updates to versions 2.41.4 or 2.42.1.

Recommended defensive actions

• Verify n8n workflows using Agent nodes, especially those with shared workflows or inline mode configurations, to assess exposure.
• Check if the current version of n8n is 2.41.4 or 2.42.1, and update if necessary.
• Review and restrict access to sensitive workflows and credentials.
• Monitor for suspicious activity related to Agent node usage.
• Perform a thorough review of n8n workflow configurations to identify potential security risks.
• Implement additional security measures, such as multi-factor authentication, to protect sensitive credentials.
• Regularly review and update n8n workflows to ensure they are secure and compliant with organizational policies.

Evidence notes

The CVE record and source item provide details on the vulnerability in n8n before 2.41.4 and 2.42.1, where an editor can bypass credential checks via Agent node parameters, potentially allowing decrypted secrets to be sent to an attacker-chosen destination.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.