CVE-2026-110853: n8n authorization bypass in Execute Sub-workflow

CVE-2026-110853 · Severity: info · Published 2026-10-14

n8n is a workflow automation platform used by organizations to build and run business processes. An authenticated member can spoof workflow identity when using the Execute Sub-workflow feature with inline JSON, allowing them to access credentials and modify workflows they should not have permission to change. This could enable unauthorized access to sensitive credentials and disruption of critical business workflows.

Technologies: N8n. Vendors: N8n.

Quick answers

Is CVE-2026-110853 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-110853 being exploited in the wild.
How severe is CVE-2026-110853?
Informational severity, published 14 October 2026.
Which products and versions are affected?
N8n before 1.123.83.
Is there a fix for CVE-2026-110853?
Yes: fixed in 1.123.83 and later. Until then: Restrict n8n instance access to fully trusted users only. Audit and restrict membership to the minimum set of users who require access to the instance. Monitor execution logs for unexpected sub-workflow executions originating from webhook-triggered workflows owned by lower-privileged members. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-110853 attacked?
It is attacked over the network.
Am I affected by CVE-2026-110853?
Check whether you run N8n at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 1.123.83 and later

Restrict n8n instance access to fully trusted users only. Audit and restrict membership to the minimum set of users who require access to the instance. Monitor execution logs for unexpected sub-workflow executions originating from webhook-triggered workflows owned by lower-privileged members.

Technical details

The vulnerability exists in the Execute Sub-workflow inline JSON mode, which trusts a user-supplied workflow identifier to authorize credential access, static data assignment, and error-workflow dispatch. An authenticated user with low privileges can supply a trusted identifier resolving to a project they do not belong to, bypassing project-level authorization checks. The attack requires authentication and user-provided input in a specific workflow configuration context.

Affected products

  • n8n n8n before 1.123.83

Timeline

  • 2026-09-30: disclosed
  • 2026-10-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.