n8n before 2.44.1 and 2.43.5 can expose other projects' data tables
Original title: n8n security advisory (AV26-1103)
Canada's Cyber Centre says a crafted workflow ID can reach data tables in other n8n projects and urges updates.
The Canadian Centre for Cyber Security issued advisory AV26-1103 on October 29, 2026, covering n8n builds prior to 2.44.1 and prior to 2.43.5. A crafted workflow ID can give access to data tables in other projects. The centre tells users and administrators to review the linked material and apply necessary updates. No CVE or exploitation status is stated.
Unconfirmed: The notice does not name a CVE or say whether the issue is being exploited.
- Serial AV26-1103 is dated October 29, 2026, with status as of October 28.
- Affected product versions are n8n prior to 2.44.1 and prior to 2.43.5.
- The described flaw is a crafted workflow ID reaching other projects' data tables.
- The notice does not name a CVE or a fixed build explicitly.
Impact: Access to data tables in other n8n projects
| Product | Affected |
|---|---|
| n8n | prior to 2.44.1 and prior to 2.43.5 |
- 1.Review the advisory links and apply available n8n updates.
- Vendors
- n8n
- Organizations
- Canadian Centre for Cyber Security
- Countries
- Canada
From the original article
1 min read at cyber.gc.ca
Serial number: AV26-1103 Date: October 29, 2026 As of October 28, 2026, n8n is affected by vulnerabilities in the following product: n8n Prior to 2. 44. 1 Prior to 2.
cyber.gc.ca
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.