n8n before 1.123.85, 2.43.5, and 2.44.1 SeaTable Trigger API Token Exposure via Execution Data
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 1.123.85, 2.44.1, 2.43.5
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
n8n, an open-source workflow automation platform, is affected when its SeaTable Trigger node stores the node's API token in error execution data. Users who can view workflow executions but lack permission to read the credential could recover that token and gain access to the connected SeaTable base.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error execution data, because failed poll requests store raw request headers. Users who can view workflow executions but cannot read the credential can recover the token and access the connected SeaTable base.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- n8n-io n8n
fixed in 1.123.85
- n8n-io n8n
From 2.44.0 · fixed in 2.44.1
- n8n-io n8n
From 2.0.0 · fixed in 2.43.5