CVE-2026-110853 in n8n
Summary
by MITRE • 10/15/2026
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The n8n automation platform, prior to version 1.123.83, contains a critical authorization bypass vulnerability that undermines the integrity of its multi-tenant architecture. This flaw specifically affects the Execute Sub-workflow node when operating in inline JSON mode. In this configuration, users can supply custom identifiers for sub-workflows without adequate server-side validation against their assigned permissions. The core technical failure lies in the application's trust model regarding workflow identity resolution. When a user triggers a sub-workflow via an inline JSON payload, n8n accepts the provided identifier as authoritative and proceeds to resolve associated credentials and configuration data based solely on that input. This design oversight allows authenticated members of the platform to bypass access control mechanisms by spoofing the identity of workflows they do not own or have permission to execute.
The operational impact of this vulnerability is severe, enabling unauthorized actors to escalate their privileges within the automation environment. By manipulating the workflow identifier in the request payload, an attacker can force n8n to resolve and utilize credentials belonging to other projects or users. This capability effectively breaks the isolation between different tenants or user groups sharing the instance. Furthermore, attackers can modify static data associated with victim workflows and manipulate error-workflow dispatches. This means that not only can sensitive authentication tokens be exfiltrated for use in subsequent attacks, but the attacker can also alter the behavior of legitimate automation processes, potentially leading to data corruption, unauthorized actions being performed under the guise of other users, or disruption of critical business logic flows.
From a classification perspective, this vulnerability aligns with CWE-287: Improper Authentication and CWE-915: Improper Control of Dynamically-Managed Code Resources. The flaw represents a classic case of insecure direct object references where the application fails to verify that the authenticated user has permission to access or modify the specific resource identified by the supplied ID. In terms of offensive security frameworks, this behavior maps directly to MITRE ATT&CK technique T1098: Account Manipulation and potentially T1534: Internal Spearphishing if used to compromise other users' accounts via credential reuse in automated tasks. The ability to spoof workflow identity allows attackers to maintain persistence within the automation pipeline by injecting malicious logic into trusted workflows or stealing credentials that grant access to external systems integrated with n8n.
Mitigation strategies must prioritize immediate patching and architectural review. Organizations running affected versions of n8n should upgrade to version 1.123.83 or later, where this authorization bypass has been remediated through stricter validation of workflow ownership during the execution phase. Until patches are applied, administrators can implement network-level controls such as Web Application Firewalls (WAF) to inspect and restrict inline JSON payloads for specific endpoints associated with sub-workflow executions. Additionally, enforcing strict input sanitization on any API endpoints that accept dynamic identifiers is crucial. Security teams should also audit existing workflows for potential exposure of sensitive credentials in logs or error messages, given the risk of credential leakage inherent in this vulnerability. Regular monitoring of execution logs for anomalous workflow invocations originating from unexpected user IDs can help detect exploitation attempts in real-time.