CVE-2026-110853: n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.83
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated n8n member can exploit it. The issue is relevant where members can configure or execute workflows using the Execute Sub-workflow node in inline JSON mode.
What access does an attacker need?
The attacker needs an authenticated member account and the ability to supply a trusted identifier through Execute Sub-workflow inline JSON. They can use that identifier to target credentials in projects they do not belong to.
What could an attacker change or access?
An attacker may cause credentials to be resolved from unauthorized projects. They may also modify another workflow's static data and its error-workflow dispatch behavior.
Which versions need remediation?
Versions of n8n before 1.123.83 are affected. Upgrade to 1.123.83 or later.