CVE-2026-85166 in n8n
Summary
by MITRE • 09/03/2026
n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node). A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can persist a node referencing a credential they do not own. When the workflow is later executed under an identity that holds the credential, the inline sub-workflow resolves the secret and can send it to an attacker-controlled endpoint, resulting in credential exfiltration.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/03/2026
The vulnerability identified in n8n versions prior to 2.35.4 and version 2.36.x prior to 2.36.2 represents a critical authorization bypass within the workflow execution engine, specifically affecting nodes that facilitate inline sub-workflows such as the Workflow Tool node. This flaw stems from an insufficient validation of credential references during the persistence phase of workflow creation or modification. In n8n workflows, credentials are typically stored securely and referenced by unique identifiers rather than raw secrets to maintain security hygiene. However, when a user creates or updates a workflow through shared editors, the REST API, Public API, or Model Context Protocol (MCP), the system fails to verify whether the requesting entity actually owns the credential being referenced in the inline JSON payload of these specific nodes. This lack of ownership verification allows an attacker with write access to any part of the workflow structure to embed references to credentials they do not possess but which are owned by other users or service accounts within the same n8n instance.
The operational impact of this vulnerability is severe, leading directly to credential exfiltration and potential unauthorized access to downstream systems. When a compromised or maliciously crafted workflow containing these invalidly referenced credentials is executed under an identity that does hold the valid credential—such as an administrator account or a service account with elevated privileges—the inline sub-workflow successfully resolves the secret value from the secure store. Because the execution context trusts the resolved credential, it can be transmitted to external endpoints controlled by an attacker. This mechanism effectively bypasses standard access controls and allows for the stealthy extraction of sensitive authentication tokens, API keys, or database passwords without triggering typical permission errors that would occur if a non-owner attempted direct usage.
From a classification perspective, this vulnerability aligns with CWE-269, Improper Privilege Management, as it involves an actor obtaining privileges they are not authorized to have by exploiting the trust relationship between workflow execution contexts and credential stores. It also maps closely to CWE-862, Missing Authorization Check, specifically within the context of resource access control for sensitive data objects like credentials. In terms of offensive security frameworks, this behavior is consistent with ATT&CK technique T1530, Data from Cloud Storage Object Exfiltration, as it involves retrieving and transmitting secrets stored in a managed service or application database to an external location. The attack vector leverages the complexity of workflow orchestration tools where multiple execution contexts can interact, highlighting the risks associated with complex permission models in automation platforms.
Mitigation strategies must prioritize immediate version upgrades to n8n 2.35.4 and later, or 2.36.2 and later, which address this validation gap by enforcing strict ownership checks on credential references within inline sub-workflows. In the interim, administrators should audit workflows for any nodes that execute external code or sub-processes, ensuring that no unauthorized users have write access to workflow definitions containing sensitive integrations. Implementing a principle of least privilege is essential; service accounts used in automated pipelines should be isolated from user-facing credentials where possible. Additionally, organizations should enable comprehensive logging on credential usage and API endpoints to detect anomalous patterns such as sudden spikes in outbound network connections following workflow executions, which may indicate active exploitation attempts targeting these unresolved references.