CVE-2026-110844 in n8n
Summary
by MITRE • 10/15/2026
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The n8n automation platform prior to version 1.123.83 is susceptible to an authorization bypass vulnerability that stems from insufficient access control checks within its nested workflow execution logic. This flaw specifically impacts users who possess editor permissions for a shared workflow, allowing them to manipulate the workflow structure in ways that circumvent standard credential isolation boundaries. The core technical issue arises when editors embed references to credentials via Workflow Tool or Workflow Retriever nodes inside inline sub-workflows. In these scenarios, the system fails to validate whether the executing user has explicit permission to access the referenced secret data before allowing its inclusion in the workflow definition.
From a technical perspective, this vulnerability exploits the way n8n resolves credential references during runtime execution versus design-time validation. When an editor configures a node within a sub-workflow and selects a credential from the available list, the platform typically performs permission checks to ensure the user is authorized to use that specific secret. However, when these credentials are embedded directly into nested or inline definitions, particularly through tools like Workflow Tool or Workflow Retriever, the authorization layer does not re-evaluate the permissions for each individual reference. Consequently, a malicious actor with editor rights can save a workflow containing references to sensitive credentials they do not own and cannot normally access.
The operational impact of this vulnerability is significant as it leads to unauthorized data exposure and potential privilege escalation within the automation environment. By embedding restricted credentials into their workflows, attackers ensure that when the parent workflow executes, these sub-workflows run using the credential values associated with the workflow owner or another authorized user. This effectively allows the attacker to perform actions under the identity of a privileged account without possessing the actual secret material themselves. The risk is compounded by the fact that this can occur in shared workflows where multiple users have varying levels of access, making it difficult for administrators to trace which specific credentials were misused based on standard audit logs alone.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-913 Control of Controller Components, as it involves a failure to properly enforce identity verification before granting access to sensitive resources. In the context of the MITRE ATT&CK framework, this behavior is consistent with T1550 Use Alternate Authentication Credentials, where an adversary leverages existing credentials or configurations to gain unauthorized access. It also reflects aspects of T1098 Unauthorized Account Modification if the attacker modifies workflow definitions to persist their malicious configuration for future exploitation.
To mitigate this risk, organizations must immediately upgrade n8n to version 1.123.83 or later, where these authorization checks have been hardened to validate permissions at every level of nested execution. Until an update is applied, administrators should restrict editor access on shared workflows containing sensitive integrations and enforce strict code review processes for any workflow modifications involving credential references. Additionally, implementing robust monitoring for unusual patterns in sub-workflow executions can help detect potential exploitation attempts by flagging workflows that reference credentials outside the normal permission scope of their creators.