CVE-2026-110844
7.2HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-863
Impact
Authenticated users with workflow editing rights can access and execute unauthorized credentials by embedding them into inline sub-workflows. This allows editors to hijack and exfiltrate secrets owned by other users on the instance.
Root cause
Improper authorization checks permit nested inline Workflow Tool and Workflow Retriever definitions to execute using the workflow owner's credential context rather than the caller's.
Affected systems
n8n before 1.123.83
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade n8n to version 1.123.83 or later. If upgrading immediately is not possible, restrict workflow sharing permissions and revoke edit access for untrusted users.
$ npm update -g n8nAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.