N8N N8N — CVE-2026-54305 (Critical)

Date Jun 23, 2026

Type Vendor advisory

Signal Critical vendor advisory

Vendor / Product N8N · N8N

CVE CVE-2026-54305

Critical vendor advisory CVE-2026-54305

Summary

n8n is an open source workflow automation platform. Prior to 1.123.55, 2.25.7, and 2.26.2, three EE endpoints used by the Dynamic Credentials feature accepted any authenticated n8n session without performing per-resource ownership or scope checks on the target workflow or credential. An authenticated user with no project membership or credential sharing relationship could enumerate credential identifiers, names, and types referenced by any private workflow in the instance, initiate an OAuth authorization flow against another user's credential to overwrite its stored tokens with tokens bound to

Why it matters

This CVE carries a CRITICAL severity rating (CVSS 9.9) in N8N N8N. Patch or mitigate promptly. EPSS percentile: 25%.

Operator check

Review CVE-2026-54305 in your asset inventory. Apply patches per vendor guidance and verify N8N is not exposed. CVSS score: 9.9. EPSS probability: 0.3%; percentile: 25%.

Sources

NVD — CVE-2026-54305 Source reference

PatchBrief uses public sources. It does not scan environments, verify exposure, or replace vendor guidance.

Get watched-vendor alerts Subscribe free Back to feed