CVE-2026-54307: n8n

Critical severity, CVSS 9.6. EPSS: 0.4% chance of exploitation in the next 30 days.

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, a member-level user with editor access to a shared workflow could reference credentials they do not own via specific public API endpoints. Credential ownership checks were only enforced partially leading to cross-user credential access. This issue affects instances where workflow sharing is enabled and at least one workflow has been shared with a member-level user as an Editor. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2.

Affected products

• n8n n8n: before 1.123.55 (fixed in 1.123.55); from 2.0.0, before 2.25.7 (fixed in 2.25.7); from 2.26.0, before 2.26.2 (fixed in 2.26.2)

Published 2026-06-23. Last modified 2026-06-26.