AI Threat AlertCVE-2026-110853: n8n: workflow identity spoofing exposes cross-project credentials
HIGHn8n before 1.123.83 has an authorization bypass in the Execute Sub-workflow node's inline JSON mode. An authenticated member can supply a trusted workflow identifier and be treated as a different workflow. That lets them resolve credentials from projects they don't belong to, and tamper with another workflow's static data and error-workflow dispatch. No CVSS or EPSS score has been published yet, it is not in CISA KEV, and no public exploit or Nuclei template exists, so near-term mass exploitation looks unlikely. The risk is insider or compromised-member abuse in multi-team n8n instances, where AI agents hold LLM API keys, database credentials and SaaS tokens. Upgrade to n8n 1.123.83 or later, and until then limit member accounts and review which credentials are shared across projects.
What is the risk?
Severity is not yet scored. Likely medium to high based on the weakness (CWE-639, authorization bypass through a user-controlled key). Exploitation needs an authenticated member account, but no user interaction. The attack is low-complexity because it only requires crafting inline JSON for the sub-workflow node. There is no KEV listing, public exploit or scanner template at publication, and exposure is limited to multi-project or multi-tenant n8n deployments. Package context data is sparse (no dependents or scorecard data), so blast radius is estimated from the product's typical use as an AI orchestration hub.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What should I do?
1 step1) Upgrade n8n to 1.123.83 or later (see GHSA-866p-xg8v-g2q7). 2) Until patched, restrict member-level workflow creation and editing, and remove untrusted or unnecessary member accounts. 3) Review credential sharing and scope credentials to the narrowest project. 4) Audit workflows for Execute Sub-workflow nodes using inline JSON mode with unexpected workflow identifier fields. 5) Check execution logs for sub-workflow runs that access credentials outside the caller's project, and for unexpected changes to workflow static data or error-workflow settings. 6) Rotate credentials that were exposed to members outside their owning project.
What does CISA's SSVC say?
Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-110853?
n8n before 1.123.83 has an authorization bypass in the Execute Sub-workflow node's inline JSON mode. An authenticated member can supply a trusted workflow identifier and be treated as a different workflow. That lets them resolve credentials from projects they don't belong to, and tamper with another workflow's static data and error-workflow dispatch. No CVSS or EPSS score has been published yet, it is not in CISA KEV, and no public exploit or Nuclei template exists, so near-term mass exploitation looks unlikely. The risk is insider or compromised-member abuse in multi-team n8n instances, where AI agents hold LLM API keys, database credentials and SaaS tokens. Upgrade to n8n 1.123.83 or later, and until then limit member accounts and review which credentials are shared across projects.
Is CVE-2026-110853 actively exploited?
No confirmed active exploitation of CVE-2026-110853 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-110853?
1) Upgrade n8n to 1.123.83 or later (see GHSA-866p-xg8v-g2q7). 2) Until patched, restrict member-level workflow creation and editing, and remove untrusted or unnecessary member accounts. 3) Review credential sharing and scope credentials to the narrowest project. 4) Audit workflows for Execute Sub-workflow nodes using inline JSON mode with unexpected workflow identifier fields. 5) Check execution logs for sub-workflow runs that access credentials outside the caller's project, and for unexpected changes to workflow static data or error-workflow settings. 6) Rotate credentials that were exposed to members outside their owning project.
What systems are affected by CVE-2026-110853?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, LLM workflow orchestration, multi-tenant automation platforms, RAG pipelines.
What is the CVSS score for CVE-2026-110853?
No CVSS score has been assigned yet.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0083Credentials from AI Agent ConfigurationAML.T0098AI Agent Tool Credential HarvestingCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.83 contains an authorization bypass vulnerability that allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. Attackers can set this identifier to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch.
Exploitation Scenario
A contractor with a member account in a low-privilege n8n project builds a workflow with an Execute Sub-workflow node in inline JSON mode. They set the trusted workflow identifier to that of a workflow in the finance or AI-platform project. The engine resolves credentials as if the call came from the trusted workflow, so the attacker uses the OpenAI API key, database password or Slack token stored there. They also modify the victim workflow's static data and error-workflow dispatch to change its behavior or route failure data to a workflow they control.
Weaknesses (CWE)
CWE-639Authorization Bypass Through User-Controlled KeyPrimaryCWE-639Authorization Bypass Through User-Controlled KeyCWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.
- [Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
- [Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.
Source: MITRE CWE corpus.
References
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n