CVE-2026-118675 in n8n
Summary
by MITRE • 10/28/2026
n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The n8n automation platform, prior to versions 1.123.85, 2.43.5, and 2.44.1, suffers from a critical credential guard bypass vulnerability rooted in the improper validation of input sources within its workflow execution engine. This flaw specifically affects users who have editor privileges on shared workflows, allowing them to manipulate how sub-workflows are loaded during runtime. The core technical issue lies in the Execute Sub-workflow node, which is designed to invoke other n8n workflows as part of a larger automation chain. In secure configurations, this node should strictly enforce that only predefined, trusted internal workflows can be executed by editors who do not possess full administrative rights. However, due to insufficient sanitization and validation logic, the application fails to restrict the source parameter when it is set to load content from external URLs or local file systems rather than referencing an existing workflow ID within the n8n instance.
This architectural oversight enables a malicious actor with editor access to configure the Execute Sub-workflow node to fetch arbitrary code or configuration data from an attacker-controlled remote server via HTTP URL, or potentially from a locally accessible file path if the environment permits such operations. By pointing this parameter to a crafted endpoint, the attacker can serve a specially constructed workflow definition that exploits the credential management subsystem of n8n. When the parent workflow executes and triggers this sub-workflow load, the application processes the incoming data without adequately verifying its origin or integrity against the allowed list of trusted sources. This lack of strict source validation effectively neutralizes the intended security boundaries imposed by the role-based access control model, as the system treats the externally sourced content with a level of trust that bypasses standard credential restrictions.
The operational impact of this vulnerability is severe, primarily centering on unauthorized data exfiltration and privilege escalation within the automation ecosystem. Attackers can leverage this mechanism to resolve project credentials stored in n8n’s encrypted vaults. By structuring the malicious sub-workflow to access these resolved values during execution, the attacker can cause the system to return decrypted credential strings back through the workflow output or via side-channel mechanisms such as HTTP callbacks to an external server controlled by the adversary. This results in a complete compromise of sensitive authentication tokens, API keys, and database passwords associated with various integrations configured within n8n. Consequently, this leads to potential data breaches, unauthorized access to third-party services connected through these credentials, and further lateral movement across integrated systems that rely on these compromised secrets for security.
From a classification perspective, this vulnerability aligns with CWE-94 Improper Control of Generation of Code (Code Injection) in the context of dynamic workflow execution, as well as CWE-284 Improper Access Control regarding the bypassing of role-based restrictions. In terms of adversary tactics, it maps to ATT&CK technique T1059 Command and Scripting Interpreter for executing arbitrary logic and potentially T1530 Data from Cloud Storage if external sources are used to host malicious payloads. The vulnerability highlights a common risk in low-code automation platforms where dynamic loading features can be abused when input validation is not strictly enforced against the principle of least privilege.
To mitigate this issue, organizations must immediately upgrade n8n to version 1.123.85 or later for legacy branches, and versions 2.43.5 or 2.44.1 or later for current releases, as these updates contain patches that enforce stricter validation on the source parameter of the Execute Sub-workflow node. Administrators should also review existing shared workflows to identify any nodes configured with external URL sources for sub-workflows and replace them with references to internal workflow IDs where possible. Additionally, implementing network-level restrictions such as egress filtering can limit the ability of n8n instances to communicate with arbitrary external endpoints, thereby reducing the attack surface even if similar vulnerabilities exist in other components. Regular auditing of user permissions is also recommended to ensure that editor roles are granted only on workflows where dynamic execution risks have been assessed and minimized through secure configuration practices.