{"data":{"id":"a52e3144-b1e5-463f-982e-d1ee78b27c3a","title":"GHSA-r4v6-9fqc-w5jr: n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay","summary":"The n8n dynamic-node-parameters endpoints did not check whether an authenticated caller was authorized to use a supplied credential reference. A user with access to a shared workflow could submit a foreign credential ID, causing the backend to decrypt and use another user's credential against a destination URL the caller controls, which effectively exfiltrates a reusable API key. The source says the issue is not limited to any single node type.","solution":"The issue has been fixed in n8n version 2.18.0. Users should upgrade to this version or later. If upgrading is not immediately possible, administrators should restrict n8n access to fully trusted users only and avoid sharing workflows with users who should not have access to the credentials those workflows reference. The source states these workarounds do not fully remediate the risk and are short-term measures only.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-r4v6-9fqc-w5jr","publishedAt":"2026-04-29T21:22:26.000Z","cveId":"CVE-2026-42226","cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["n8n@< 1.123.33 (fixed: 1.123.33)","n8n@>= 2.17.0, < 2.17.5 (fixed: 2.17.5)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.0026,"epssCheckedAt":"2026-11-09T18:09:53.615Z","kevDateAdded":null,"advisoryAliases":["GHSA-r4v6-9fqc-w5jr"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-04-29T21:22:26.000Z","fixReleasedAt":"2026-04-22T09:43:04.604Z","daysToFix":-7,"fixCheckedAt":"2026-10-29T21:37:12.550Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.8,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"2.17.5","matchedVersion":"2.17.5","fixReleasedAt":"2026-04-22T09:43:04.604Z","daysToFix":-7,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:12.405Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"1.123.33","matchedVersion":"1.123.33","fixReleasedAt":"2026-04-22T10:03:05.457Z","daysToFix":-7,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:37:12.405Z"}]}}