CVE-2026-118642: n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.85 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.43.5 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.44.1
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated n8n member can exploit it if they know the ID of a credential they are not authorized to access. The issue can expose decrypted credentials by sending them to an attacker-controlled server.
What exploitation conditions are required?
The attacker must be able to run an Execute Workflow node in inline JSON mode and use an inline sub-workflow node with a non-boolean disabled value. Exploitation also requires knowledge of the target credential ID.
Which versions need remediation?
Affected releases are n8n versions before 1.123.85, 2.43.5, and 2.44.1. Upgrade to the applicable fixed release or later.