CVE-2026-54305 is a critical flaw (CVSS 9.9) in n8n. Three Enterprise endpoints for Dynamic Credentials skipped ownership checks, so any authenticated user could list, overwrite or revoke another user's stored credentials. It is fixed in n8n 1.123.55, 2.25.7 and 2.26.2.
What's affected
- n8n before 1.123.55, before 2.25.7 and before 2.26.2, per the record.
- Fixed in 1.123.55, 2.25.7 and 2.26.2.
- The advisory says only Enterprise instances with the Dynamic Credentials feature enabled are affected.
How to check if you're exposed
Check your version with the n8n version command, or read the image tag if you run n8n in Docker. If you are on the Enterprise edition, confirm whether the Dynamic Credentials feature is turned on. If it is off, you are outside the affected configuration. Also check how many accounts exist on the instance, since the attacker only needs a valid login with no project membership.
What to do now
- Upgrade to 1.123.55, 2.25.7 or 2.26.2 or later, on the branch you use.
- As a stopgap, the advisory suggests restricting instance access, so limit sign ups and remove accounts you do not need.
- Audit credentials used by workflows for unexpected OAuth identities, and reconnect any you cannot account for.
- Check workflows that call external services for traffic to destinations you do not recognize.
Why it matters
The classes are CWE-200, CWE-284: exposure of information, and improper access control. The endpoints trusted any valid session and never asked whether that user owned the workflow or credential in the request.
That gap matters because a credential in n8n stands in for an account at another service. If someone replaces the stored tokens, workflows keep running, but under the attacker's identity, which is a quiet route for data to leave. The record does not mark the CVE as exploited in the wild.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
I do not use Enterprise features. Am I safe?
The advisory limits the issue to Enterprise instances with Dynamic Credentials enabled. Upgrading is still sensible, since the release also carries other fixes.
Sources
Last reviewed: 19 October 2026.
