GHSA-cj9h-qx8g-pq2g: n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
Summary
n8n, a workflow automation tool, had a security flaw where someone with editor access to a shared workflow could steal credentials (login information) they weren't supposed to access by hiding them inside an Execute Sub-workflow node's inline JSON (a way to embed workflow code as data). The vulnerability only worked if workflow sharing was enabled and the attacker knew the credential's ID.
Solution / Mitigation
The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily: restrict workflow sharing to trusted users only and avoid giving Editor access on workflows using sensitive credentials; audit shared workflows for Execute Sub-workflow nodes with Source = "Parameter" and review their inline workflow definitions for unexpected credential references; and restrict network egress from the n8n instance to prevent connections to attacker-controlled endpoints. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Classification
Affected Vendors
Affected Packages
Original source: https://github.com/advisories/GHSA-cj9h-qx8g-pq2g
First tracked: July 22, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 85%