CVE-2026-85166: n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node
n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node). A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can persist a node referencing a credential they do not own. When the workflow is later executed under an identity that holds the credential, the inline sub-workflow resolves the secret and can send it to an attacker-controlled endpoint, resulting in credential exfiltration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.35.4 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.36.2
Event History
Frequently Asked Questions
Which users or interfaces can introduce a malicious credential reference?
A shared-workflow editor can do so, as can any user who can create or update workflows through the REST API, Public API, or MCP.
When are the referenced credentials exposed?
The credential is resolved when the workflow executes under an identity that holds it. The inline sub-workflow can then send the secret to an attacker-controlled endpoint.
Which n8n versions contain the validation issue?
Affected versions are those before 2.35.4 and the 2.36.x line before 2.36.2.