Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-118642n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows

High 7.1

In plain English

A high-severity incorrect authorization in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 12% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 88.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	0 – before 1.123.85
n8n-io	n8n	2.44.0 – before 2.44.1
n8n-io	n8n	2.0.0 – before 2.43.5

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-8vrr-mgc5-jg55) vendor-advisory
VulnCheck Advisory: n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows third-party-advisory