Skip to content
AI Sec Watch
HighVulnerability

GHSA-cj9h-qx8g-pq2g: n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON

Source
GitHub Advisory(opens in a new tab)
Identifier
GHSA-cj9h-qx8g-pq2g
Published
Record updated
View JSON
Affected
  • n8n >= 2.0.0-rc.0, < 2.31.5, fixed in 2.31.5, released July 22, 2026, on the day of disclosure
  • n8n >= 2.32.0, < 2.32.1, fixed in 2.32.1, released July 22, 2026, on the day of disclosure
  • n8n < 1.123.67, fixed in 1.123.67, released July 22, 2026, on the day of disclosure

Summary

n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow could reference a credential they were not permitted to use, and it passed save-time and runtime validation, resolving in the parent workflow's project context. Exploitation requires workflow sharing to be enabled, an explicit Editor grant, and knowledge of the target credential's ID.

Mitigation

Fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1; upgrade to one of these or later. Temporary workarounds: restrict workflow sharing to fully trusted users, audit shared workflows for Execute Sub-workflow nodes with Source = "Parameter" and review their inline definitions for unexpected credential references, and restrict network egress from the n8n instance. These workarounds do not fully remediate the risk and are short-term measures only.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • n8nnpmLLM dependency since 2026-02-10

Related items