CVE-2026-54305: n8n: missing authorization checks in Dynamic Credentials endpoints
CVE-2026-54305 affects n8n versions before 1.123.55, 2.25.7 and 2.26.2 (for the 2.x line, from 2.0.0 and from 2.26.0 respectively). Three enterprise edition endpoints used by the Dynamic Credentials feature accepted any authenticated session without per-resource ownership or scope checks, which the record describes as exposing credential metadata and allowing credential token overwrite or revocation. Upgrading to the fixed versions is the documented remediation.
Overview
n8n is an open source workflow automation platform. According to the GitHub Security Advisory, three enterprise edition (EE) endpoints used by the Dynamic Credentials feature did not enforce per-resource ownership or scope checks on the target workflow or credential. The weakness is classified as CWE-200 (Exposure of Sensitive Information) in the record.
Impact
The record describes three consequences for an authenticated user without project membership or a credential sharing relationship:
- Enumeration of credential identifiers, names and types referenced by private workflows.
- Initiation of an OAuth authorization flow against another user's credential, overwriting stored tokens.
- Revocation of another user's stored credential tokens, which the record says would break affected workflows.
The record also states that workflows relying on a taken-over credential could run under the attacker's OAuth identity, which could enable data exfiltration and persistent integration takeover. These are the described impacts; the record does not quantify real-world effects.
Affected products and versions
The record lists the product as n8n and the following ranges:
- Versions before 1.123.55.
- Versions from 2.0.0 before 2.25.7.
- Versions from 2.26.0 before 2.26.2.
Exploitation status
The CISA KEV catalog entry in the record is not listed. No confirmed exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Upgrade n8n to 1.123.55, 2.25.7 or 2.26.2, matching the release line in use, as stated in the GitHub Security Advisory.
- The advisory is the vendor source for the fix and the mitigation guidance; consult it for the full text.
- Review which users have access to instances with the Dynamic Credentials feature in use, and limit account creation where possible while patching is pending.
Detection guidance
- Review audit and application logs for unexpected OAuth authorization flows or credential changes initiated by users who do not own or share the affected credentials.
- Look for unexpected token revocation events or workflow failures tied to credential authentication errors.
- Correlate credential-related activity with user and project membership records to identify access outside expected relationships.
Limitations of the available information
The record does not list the specific endpoint paths, the exact affected EE components, or any proof-of-concept details, and it does not state whether the issue has been exploited. The CVSS 3.1 score of 9.9 is from NVD and the CVSS 4.0 score of 8.9 is from the CNA; the record does not explain the difference. Whether a given deployment is affected depends on its edition, version and use of the feature, which the record does not fully establish.
Frequently asked questions
What is CVE-2026-54305?
It is a vulnerability in n8n in which three enterprise edition endpoints used by Dynamic Credentials did not check ownership or scope for the target workflow or credential, according to the record.
Which versions are fixed?
The record states the issue is fixed in 1.123.55, 2.25.7 and 2.26.2. Users should upgrade to the release line they run.
Is this vulnerability known to be exploited?
The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.