Executive brief
n8n is a workflow automation platform that allows users to build and execute workflows with access controls. A security flaw allows users who can build Agents to bypass workflow caller restrictions and invoke workflows that were explicitly restricted by the workflow owner, potentially exposing sensitive data or operations. This undermines access control policies and could lead to unauthorized data disclosure or workflow manipulation.
Technical details
The vulnerability is a missing authorization control (CWE-862) in the Agent tool execution path. When workflows are attached as tools to an Agent, the sub-workflow caller policy (the "_This workflow can be called by_" setting) was not enforced, even though the same restriction was properly enforced in the Execute Workflow node. An authenticated attacker with Agent-building permissions could attach a restricted workflow as an Agent tool, invoke it, and read the workflow's output, bypassing the intended access control. The attack requires network access and the ability to create Agents but no additional user interaction. Patches are available in n8n versions 2.37.7 and 2.38.2 and later.
Affected products
- n8n n8n < 2.37.7, >= 2.38.0 < 2.38.2
Timeline
- 2026-09-08: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-09-08: patched: Fixed in n8n 2.37.7 and 2.38.2