CVE-2026-85171

n8n versions before 1.123.73, 2.35.4, and 2.36.2 leak decrypted credentials for the Strapi, SeaTable, and Mailcheck integration nodes into execution error data (CWE-532). When a workflow execution reaches the authentication step of one of these nodes, the decrypted secret is sent via a legacy raw HTTP helper outside error handling, so if that request fails, the plaintext credential is persisted in the execution's error data. Any authenticated user can then read the plaintext secret for their own executions through the REST API, bypassing the blank-value redaction that the credentials API normally enforces. Affected users are n8n operators, both self-hosted and n8n Cloud, who run workflows using these three nodes with stored credentials, and an attacker with a low-privileged authenticated account gains disclosure of API keys or tokens for the connected Strapi, SeaTable, or Mailcheck service. No public proof-of-concept, CISA KEV listing, or known in-the-wild exploitation is reported; EPSS estimates only about a 0.4% chance of exploitation within 30 days.

What to do: Upgrade n8n to 1.123.73, 2.35.4, or 2.36.2 (matching your release branch) or later. Audit and purge execution error data for runs of the Strapi, SeaTable, and Mailcheck nodes, rotate any credentials those nodes used, and consider restricting which users can read execution data through the REST API.