CVE-2026-54305

{
  "id": "CVE-2026-54305",
  "sourceIdentifier": "[email protected]",
  "published": "2026-06-23T17:17:06.743",
  "lastModified": "2026-10-25T23:10:00.167",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature accepted any authenticated n8n session without performing per-resource ownership or scope checks on the target workflow or credential. An authenticated user with no project membership or credential sharing relationship could enumerate credential identifiers, names, and types referenced by any private workflow in the instance, initiate an OAuth authorization flow against another user's credential to overwrite its stored tokens with tokens bound to an account they control, or revoke another user's stored credential tokens entirely. Workflows relying on a hijacked credential would subsequently execute under the attacker's OAuth identity, enabling data exfiltration to attacker-controlled external services and persistent takeover of integrations. Token revocation would break affected workflows. This vulnerability is fixed in 1.123.55, 2.25.7, and 2.26.2."
    },
    {
      "lang": "es",
      "value": "n8n es una plataforma de automatización de flujos de trabajo de código abierto. Antes de las versiones 1.123.55, 2.25.7 y 2.26.2, tres puntos finales EE utilizados por la función de Credenciales Dinámicas aceptaban cualquier sesión n8n autenticada sin realizar comprobaciones de propiedad por recurso o de alcance en el flujo de trabajo o credencial objetivo. Un usuario autenticado sin membresía de proyecto o relación de compartición de credenciales podía enumerar identificadores, nombres y tipos de credenciales referenciados por cualquier flujo de trabajo privado en la instancia, iniciar un flujo de autorización OAuth contra la credencial de otro usuario para sobrescribir sus tokens almacenados con tokens vinculados a una cuenta que ellos controlan, o revocar completamente los tokens de credenciales almacenados de otro usuario. Los flujos de trabajo que dependían de una credencial secuestrada se ejecutarían posteriormente bajo la identidad OAuth del atacante, permitiendo la exfiltración de datos a servicios externos controlados por el atacante y la toma de control persistente de las integraciones. La revocación de tokens rompería los flujos de trabajo afectados. Esta vulnerabilidad está corregida en las versiones 1.123.55, 2.25.7 y 2.26.2."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "n8n-io",
          "product": "n8n",
          "versions": [
            {
              "version": "< 1.123.55",
              "status": "affected"
            },
            {
              "version": ">= 2.0.0-rc.0, < 2.25.7",
              "status": "affected"
            },
            {
              "version": ">= 2.26.0, < 2.26.2",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV40": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "4.0",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "HIGH",
          "vulnAvailabilityImpact": "LOW",
          "subConfidentialityImpact": "HIGH",
          "subIntegrityImpact": "HIGH",
          "subAvailabilityImpact": "LOW",
          "exploitMaturity": "NOT_DEFINED",
          "confidentialityRequirement": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "valueDensity": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
          "baseScore": 9.9,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-23T17:44:34.716415Z",
          "id": "CVE-2026-54305",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
              "versionEndExcluding": "1.123.55",
              "matchCriteriaId": "89E9BFA6-AA6E-4394-B819-7FFB7DFE203C"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "2.0.0",
              "versionEndExcluding": "2.25.7",
              "matchCriteriaId": "0F398456-8B34-498A-B8A3-915C84C424F4"
            },
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*",
              "versionStartIncluding": "2.26.0",
              "versionEndExcluding": "2.26.2",
              "matchCriteriaId": "970A6AA3-03FF-4B9D-85C1-462C5C7F7171"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-2j5h-858j-5mpf",
      "source": "[email protected]",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ]
    }
  ]
}