n8n per-user credential theft: October 14 advisory and action
What the October 14, 2026 n8n per-user credential theft advisory says about error workflows, fixed versions and administrators’ next steps.
Checked against the cited sources on .
The n8n per-user credential theft announcement
The n8n per-user credential theft advisory published on October 14, 2026 describes a vulnerability involving an error workflow inheriting another user’s identity. The official announcement, GHSA-pcr3-v5vr-qppf, identifies fixed versions and recommends upgrading.
The exposure described involves a project editor pointing a colleague’s workflow at an error workflow the editor owns. When the colleague’s workflow failed, the inherited user identity could allow the editor to resolve the colleague’s per-user credential secrets. This describes a possible attack path; the advisory does not report observed theft, exploitation prevalence or affected customer counts.
In our view, the important permission boundary here is who can choose the error workflow for someone else’s automation. Teams should treat that decision as a security concern alongside the recovery logic itself.
What changed in n8n execution context inheritance
For the affected error-workflow execution path, the announcement says the error workflow now receives only non-identity fields. That is the stated change to n8n execution context inheritance. The advisory does not enumerate those fields or describe compatibility effects.
The n8n per-user credential theft announcement identifies n8n 2.42.2 and 2.41.5 as containing the fix and instructs users to upgrade to one of those versions or later. Its affected-version fields separately list versions below 2.42.2 and below 2.41.5, without explaining branch selection.
Our editorial suggestion is to have the instance owner identify the installed version and release branch before planning the upgrade. The announcement provides no installation-specific upgrade procedure, so this article does not supply deployment commands.
n8n error workflow security: upgrade and temporary measures
For the n8n per-user credential theft risk covered by this announcement, upgrading is the recommended action. If upgrading is delayed, the advisory tells administrators to consider the temporary measures below. They do not fully remediate the risk.
We would prioritize assigning responsibility for the upgrade over treating temporary restrictions as a finished fix. That is our practical recommendation, separate from the announcement’s listed measures.
What the announcement leaves unstated
The announcement does not state which editions or hosted plans are affected, or whether hosted instances were patched automatically. Its publication date does not establish when exploitation began or when patches first became available.
It also does not provide credential-rotation instructions, incident-response procedures, a detailed audit procedure or a verification test. Those details cannot be inferred from the announced fix.
