CVE-2026-45732 n8n-io CVE debrief

Who should care

Security teams and administrators responsible for n8n workflow automation platforms should be aware of this vulnerability. Specifically, those who use OAuth1 and OAuth2 credentials for authentication and authorization should take immediate action to update to the patched versions. Additionally, teams using shared credentials or integrations with external services should be cautious of potential data exfiltration and takeover risks.

Technical summary

The vulnerability exists in the OAuth1 and OAuth2 credential reconnect endpoints of n8n, allowing an authenticated user with read-only access to a shared credential to initiate an OAuth reconnect flow. This flow can be exploited to overwrite the stored token material for that credential with tokens bound to an external account controlled by the attacker. As a result, workflows relying on the affected credential would subsequently execute under the attacker's OAuth identity, enabling data exfiltration to attacker-controlled external services and persistent takeover of shared integrations. The CVSS score for this vulnerability is 8.3, indicating a high severity level.

Defensive priority

High priority should be given to updating n8n to versions 1.123.43, 2.22.1, or 2.20.7, as applicable. Additionally, defenders should review and monitor their n8n workflows and integrations for any suspicious activity, especially those using OAuth1 and OAuth2 credentials.

Recommended defensive actions

• Update n8n to version 1.123.43, 2.22.1, or 2.20.7, as applicable.
• Review and monitor n8n workflows and integrations for suspicious activity, especially those using OAuth1 and OAuth2 credentials.
• Implement additional logging and monitoring to detect potential data exfiltration and takeover attempts.
• Consider implementing compensating controls, such as restricting access to sensitive workflows and integrations.
• Verify that all shared credentials and integrations are properly secured and monitored.

Evidence notes

The CVE-2026-45732 vulnerability was publicly disclosed on June 23, 2026, and the NVD record was last modified on June 26, 2026. The vulnerability affects n8n versions prior to 1.123.43, 2.22.1, and 2.20.7. The CVSS score for this vulnerability is 8.3, indicating a high severity level. The CWE-639 weakness is associated with this vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.