n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming scopes could select a credential belonging to another project and send its decrypted secret to an attacker-controlled endpoint. The affected authorization boundary is packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts and the credential:read scope. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00272.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

No data.

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://github.com/n8n-io/n8n/releases/tag/[email protected] cve-icon cve-icon
https://github.com/n8n-io/n8n/releases/tag/[email protected] cve-icon cve-icon
https://github.com/n8n-io/n8n/releases/tag/[email protected] cve-icon cve-icon
https://github.com/n8n-io/n8n/security/advisories/GHSA-pq6c-vh67-xpm3 cve-icon cve-icon
History

Tue, 08 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming scopes could select a credential belonging to another project and send its decrypted secret to an attacker-controlled endpoint. The affected authorization boundary is packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts and the credential:read scope. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Title n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
Weaknesses CWE-862
References
Metrics cvssV4_0

{'score': 5.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-08T21:19:53.255Z

Reserved: 2026-09-08T16:44:23.781Z

Link: CVE-2026-86993

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-08T22:19:17.810

Modified: 2026-09-08T22:19:17.810

Link: CVE-2026-86993

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-09T09:00:11Z

Weaknesses