---
id: CVE-2026-85171
title: >-
  n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure
  vulnerability in the Strapi, SeaTable, and Mailcheck nodes
summary: >-
  n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure
  vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send
  their decrypted credentials to the authentication endpoint via the raw legacy
  HTTP helper…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-532
vendor: n8n
product: n8n
affected:
  - n8n < 1.123.73
  - 'n8n >= 2.0.0, < 2.35.4'
  - 'n8n >= 2.36.0, < 2.36.2'
patched:
  - n8n 2.36.2
published: '2026-09-03'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T21:38:07.557'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85171'
references:
  - url: 'https://github.com/n8n-io/n8n/security/advisories/GHSA-vrv8-j27g-g7cr'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/n8n-before-1.123.73-credential-exposure-via-error-logging
    label: disclosure@vulncheck.com
tags:
  - nvd
epss: 0.00324
epssPercentile: 0.25729
ingestedAt: '2026-09-08T21:11:12.290Z'
---

## Overview

n8n before 1.123.73, 2.35.4, and 2.36.2 contains a credential exposure vulnerability in the Strapi, SeaTable, and Mailcheck nodes. These nodes send their decrypted credentials to the authentication endpoint via the raw legacy HTTP helper outside any error handling, causing the plaintext secret to be persisted in execution error data. Any authenticated user can read the plaintext secret from their own execution through the REST API, bypassing the blank-value redaction enforced by the credentials API.

## Affected

- `n8n < 1.123.73`
- `n8n >= 2.0.0, < 2.35.4`
- `n8n >= 2.36.0, < 2.36.2`

## Remediation

Upgrade past the affected range:

- `n8n 2.36.2`