Vulnerability · Published Oct 28, 2026 · Assigned by VulnCheck

CVE-2026-118675n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow

High 7.1

In plain English

A high-severity incorrect authorization in n8n from n8n-io. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.2%top 93.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values.

Affected products (as reported)

Vendor	Product	Versions
n8n-io	n8n	0 – before 1.123.85
n8n-io	n8n	2.44.0 – before 2.44.1
n8n-io	n8n	2.0.0 – before 2.43.5

Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

References

GitHub Security Advisory (GHSA-8crx-5h96-q72q) vendor-advisory
VulnCheck Advisory: n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow third-party-advisory