CVE-2026-54307 is a critical flaw (CVSS 9.6 in the record) in n8n. A member who has editor access to a shared workflow could reference credentials they do not own through certain public API endpoints. It is fixed in n8n 1.123.55, 2.25.7 and 2.26.2.
What's affected
- n8n before 1.123.55, before 2.25.7 and before 2.26.2, per the record.
- Fixed in 1.123.55, 2.25.7 and 2.26.2.
- Instances where workflow sharing is on and at least one workflow is shared with a member as an Editor.
How to check if you're exposed
Confirm your n8n version with the n8n version command or the container tag. Then check sharing. List which workflows are shared with members as Editors. If there are none, the described condition does not hold today, though it can appear any time someone shares a workflow.
What to do now
- Upgrade to 1.123.55, 2.25.7 or 2.26.2 or later.
- Until then, share workflows only with fully trusted users, as the advisory suggests.
- Audit shared workflows for credential references you do not expect and for recent edits.
- Remove Editor access that is no longer needed.
Why it matters
The class is CWE-863, incorrect authorization. The advisory says ownership checks were enforced only in part, so some API paths accepted a credential reference without confirming the caller owned it.
The lesson is common to automation tools. A credential is both a secret and a permission, and any endpoint that accepts a credential id must check the caller against it every time. The record does not mark the CVE as exploited in the wild. The advisory itself calls its workarounds short term and incomplete.
For your own projects, the free in-browser dependency scan needs no install, and the Gold directory tracks this CVE.
Quick check
Does the workaround fully close the risk?
No. The advisory says the workarounds do not fully remediate the risk. Upgrade.
Sources
Last reviewed: 19 October 2026.
