GHSA-7hgx-277f-7vmg: n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy

Summary

n8n's sub-workflow caller policy, set by the "_This workflow can be called by_" option, was enforced by the Execute Workflow node but not when the same workflow was attached to an Agent as a tool. Any user who could build an Agent could call a workflow its owner had restricted and read its output. The issue is fixed in n8n 2.37.7 and 2.38.2.

Mitigation

Fixed in n8n 2.37.7 and 2.38.2; upgrade to one of these versions or later. Until then, restrict instance access to fully trusted users, audit workflows attached as Agent tools and review their caller policy settings, and remove sensitive workflows from Agent tool configurations. These workarounds do not fully remediate the risk.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmDeclares an LLM dependency

Related items

• MediumCVE-2026-122235: Jan workspace guard bypass allows file writes outside workspace via symlinksSimilar attack · NVD/CVE Database
• HighCVE-2026-122135: Mistral Vibe remote code execution via repository gpg.program settingSimilar attack · NVD/CVE Database
• HighCVE-2026-122134: Mistral Vibe remote code execution through malicious Git filter driversSimilar attack · NVD/CVE Database
• HighCVE-2026-122133: Mistral Vibe untrusted search path code execution via git.exe on WindowsSimilar attack · NVD/CVE Database
• MediumCVE-2026-121936: easyVoice server-side request forgery through openaiBaseUrl in /api/v1/ttsSimilar attack · NVD/CVE Database