GHSA-8vrr-mgc5-jg55: n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows

Published Oct 28, 2026

Updated

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade n8n to a version that resolves this vulnerability.
Fixed in 2.44.1

Event History

Oct 28, 2026

CVE Published

via OSV·06:59 PM

Data Sourced

via OSV·06:59 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker must be an authenticated n8n member and know the ID of a credential they are not permitted to access. Exploitation also requires the ability to run an Execute Workflow node using inline JSON mode.

What is required for the permission check to be bypassed?

The inline sub-workflow must use a non-boolean value for its disabled setting. Under that condition, the Execute Workflow node in inline JSON mode can skip the credential permission check.

What is the practical impact of successful exploitation?

An attacker can cause decrypted credentials associated with an inaccessible credential ID to be sent to an attacker-controlled server. The vulnerability affects credential confidentiality and may also affect systems reachable with the exposed credentials.

Which releases contain the fix?

The issue is fixed in n8n 1.123.85, 2.43.5, and 2.44.1. Versions before those releases are affected.

GHSA-8vrr-mgc5-jg55: n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is required for the permission check to be bypassed?

What is the practical impact of successful exploitation?

Which releases contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is required for the permission check to be bypassed?

What is the practical impact of successful exploitation?

Which releases contain the fix?