n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
HighCVE-2026-72763 · Published Jul 22, 2026 · updated Aug 12, 2026
## Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with editor access to a shared workflow could reference a credential they were not permitted to use inside that inline JSON; it passed both save-time and runtime validation and resolved in the parent workflow's project context, letting the member use or exfiltrate a credential they could not otherwise access. Exploitation requires workflow sharing to be enabled and the attacker to have been explicitly granted Editor access to a shared workflow. The attacker must also know the target credential's ID. ## Patches The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow sharing to fully trusted users only, and avoid granting Editor access to untrusted members on workflows that use sensitive credentials. - Audit shared workflows for Execute Sub-workflow nodes...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | < 1.123.67 | 1.123.67 |
| >= 2.32.0, < 2.32.1 | 2.32.1 | |
| >= 2.0.0-rc.0, < 2.31.5 | 2.31.5 |
Details and references
## Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with editor access to a shared workflow could reference a credential they were not permitted to use inside that inline JSON; it passed both save-time and runtime validation and resolved in the parent workflow's project context, letting the member use or exfiltrate a credential they could not otherwise access. Exploitation requires workflow sharing to be enabled and the attacker to have been explicitly granted Editor access to a shared workflow. The attacker must also know the target credential's ID. ## Patches The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow sharing to fully trusted users only, and avoid granting Editor access to untrusted members on workflows that use sensitive credentials. - Audit shared workflows for Execute Sub-workflow nodes with Source = "Parameter" and review their inline workflow definitions for unexpected credential references. - Restrict network egress from the n8n instance to prevent connections to attacker-controlled endpoints. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 4.0
- CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-863
- Also known as
- CVE-2026-72763
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 22 | n8n: Snowflake Node executeQuery Operation Allows SQL Injection via Unparameterized Expression Interpolation MediumJul 22 | Medium | 1.123.67+2 more |
| Jul 22 | n8n: SQL injectionMediumJul 22 | Medium | 1.123.67+2 more |
| Jul 22 | n8n: Cross-Tenant Module-Cache Poisoning in the JS Task RunnerMediumJul 22 | Medium | 1.123.67+2 more |
| Jul 22 | n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution DataMediumJul 22 | Medium | 1.123.64+2 more |
| Jul 22 | n8n: Unauthenticated Endpoint Allows Cancellation of Any User's Active Test WebhookMediumJul 22 | Medium | 2.27.4 |
| Jul 22 | n8n: GraphQL Node Bypasses "Allowed HTTP Request Domains" RestrictionMediumJul 22 | Medium | 1.123.64+2 more |