CVE-2026-118649

    Dashboard / Vulnerabilities / CVE-2026-118649

    CVE-2026-118649

    Published: 28 Oct 2026Last Modified: 2 Nov 2026

    Summary: n8n before 2.43.5 and 2.44.1 Authorization Bypass via Crafted Workflow ID in Data Tables

    Details: n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner project in memory by that ID, so a crafted ID such as __proto__ makes the Data Table project check match every project. An authenticated member who can create and run workflows can list, read, modify, and delete Data Table rows in all projects of the instance.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118649.json, https://github.com/n8n-io/n8n/security/advisories/GHSA-wvjj-qg37-pv73, https://nvd.nist.gov/vuln/detail/CVE-2026-118649, https://www.vulncheck.com/advisories/n8n-before-2.43.5-and-2.44.1-authorization-bypass-via-crafted-workflow-id-in-data-tables

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- bae368cacac119e8e2ac65ca3d64112daf4c8d4d
    Fixed -16b49eb4126ff394c959bcb17dfa90854268744a

    Affected versions

    [email protected]

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118649 | CVE-DB