n8n authorization bypass in Execute Sub-workflow node

Executive brief

n8n is a workflow automation tool used to connect various business services and data sources. A security flaw allowed users with 'Editor' access to a shared workflow to bypass permission checks and access sensitive credentials they were not authorized to use. By embedding specific code within a sub-workflow, an attacker could steal these credentials, potentially leading to unauthorized access to connected third-party services and corporate data.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in n8n where credential-access checks fail to validate references within an 'Execute Sub-workflow' node's inline JSON. An attacker with 'Editor' access to a shared workflow can reference a credential ID they do not have permission to use; this reference passes both save-time and runtime validation because it resolves in the parent workflow's project context. This allows the attacker to use or exfiltrate sensitive credentials. The attack requires workflow sharing to be enabled, the attacker to have Editor privileges, and knowledge of the target credential's ID. The issue is fixed in versions 1.123.67, 2.31.5, and 2.32.1.

Affected products

• n8n-io n8n < 1.123.67, >= 2.0.0-rc.0 < 2.31.5, >= 2.32.0 < 2.32.1

Timeline

• 2026-07-22: advisory
• 2026-07-22: patched

References

• https://api.github.com/users/nlgbao1340
• https://github.com/nlgbao1340
• https://api.github.com/users/nlgbao1340/gists%7B/gist_id%7D
• https://api.github.com/users/nlgbao1340/repos
• https://avatars.githubusercontent.com/u/125201610?v=4
• https://api.github.com/users/nlgbao1340/events%7B/privacy%7D