{"id":"CVE-2026-118644","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-118644","summary":"n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow.…","details":"n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of the user who started the run, to the configured error workflow. A project editor can set a colleague's workflow settings.errorWorkflow to an error workflow they own, inherit the colleague's identity when that workflow fails, and resolve the colleague's per-user dynamic credential secrets.","published":"2026-10-28T19:17:32.420","modified":"2026-10-28T19:17:32.553","cvss":{"score":7.7,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-pcr3-v5vr-qppf"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/n8n-before-2.41.5-and-2.42.2-credential-theft-via-error-workflow-context-inheritance"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-10-28T19:17:32.553"}}