CVE-2026-118643

The record

n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when operations fail in the Git, MongoDB Atlas Vector Store, and Google Cloud Storage nodes. Users who can view a workflow's executions but cannot read the credential can recover Git passwords or tokens, MongoDB database passwords, or Google access tokens from that data.

Affected packages

Related vulnerabilities

• CVE-2026-62979 jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. CWE-209
• CVE-2026-67080 HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper… CWE-209
• CVE-2026-118272 A vulnerability was detected in a2ui-project a2ui up to 0.10.6. CWE-209
• CVE-2026-108316 Tanium addressed an information disclosure vulnerability in Tanium Server. CWE-209
• CVE-2026-116478 A vulnerability was detected in a2aproject a2a-go up to 2.4.0. CWE-209
• CVE-2026-116479 A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. CWE-209
• CVE-2026-116477 A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. CWE-209
• CVE-2026-114348 webpack-dev-server is a development server that provides live reloading for webpack… CWE-209