CVE-2026-110844: n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.83
Event History
Frequently Asked Questions
Who is exposed to this issue?
n8n deployments before 1.123.83 are exposed where users can edit shared workflows and where credential access is restricted between users. The affected user is a shared-workflow editor who lacks access to credentials available to the workflow owner.
What must an attacker be able to do?
The attacker needs permission to edit a shared workflow. They can save a workflow containing Workflow Tool or Workflow Retriever inline definitions that reference credentials they are not authorized to access.
Are the restricted credentials merely referenced, or can they be used?
They can be used during execution. The nested inline sub-workflow executes with the workflow owner's credential values, allowing the editor to cause use of otherwise restricted credentials.
What version contains the fix?
Upgrade n8n to version 1.123.83 or later. Versions before 1.123.83 are affected according to the provided advisory information.