AI Threat AlertCVE-2026-118642: n8n: credential permission bypass via inline sub-workflows
HIGHn8n before 1.123.85, 2.43.5 and 2.44.1 has an authorization bypass (CWE-863): an authenticated member who knows a credential ID can run an Execute Workflow node in inline JSON mode with a non-boolean 'disabled' value, skip the permission check, and have the decrypted credential sent to a server they control. CVSS is 7.1 (high) with a changed scope, because the stolen secrets (LLM API keys, cloud tokens, database passwords) unlock systems well beyond n8n. Urgency is moderate: exploitation needs a valid low-privilege account and prior knowledge of a credential ID (high attack complexity), there is no public exploit, no Nuclei template, and the CVE is not in CISA KEV. EPSS and SSVC data are not available yet. Upgrade to 1.123.85, 2.43.5 or 2.44.1 or later, then rotate credentials that members without access could have reached, and review execution logs for inline sub-workflows that use credential IDs.
What is the risk?
Medium-high. Impact is high on confidentiality (decrypted credentials exposed) and low on integrity, with a scope change into connected systems. Exploitation needs network access, a valid member account and a known credential ID, so the barrier is real but low in multi-user n8n instances where members are semi-trusted. There is no known exploitation in the wild, no public PoC and no KEV listing. The main exposure is in shared n8n deployments that hold many AI service credentials behind per-credential sharing controls.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| n8n | npm | — | No patch |
Do you use n8n? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Until patched, restrict member accounts to trusted users and remove unneeded member access, especially on instances with sensitive credentials. 3) Rotate credentials that were stored in affected instances, prioritizing LLM API keys, cloud and database secrets. 4) Review workflows and execution history for Execute Workflow nodes in inline JSON mode, 'disabled' fields with non-boolean values, and outbound HTTP calls to unfamiliar hosts. 5) Apply egress filtering on the n8n host to limit calls to unapproved destinations. 6) Monitor audit logs for credential use by users who are not credential owners or sharees.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-118642?
n8n before 1.123.85, 2.43.5 and 2.44.1 has an authorization bypass (CWE-863): an authenticated member who knows a credential ID can run an Execute Workflow node in inline JSON mode with a non-boolean 'disabled' value, skip the permission check, and have the decrypted credential sent to a server they control. CVSS is 7.1 (high) with a changed scope, because the stolen secrets (LLM API keys, cloud tokens, database passwords) unlock systems well beyond n8n. Urgency is moderate: exploitation needs a valid low-privilege account and prior knowledge of a credential ID (high attack complexity), there is no public exploit, no Nuclei template, and the CVE is not in CISA KEV. EPSS and SSVC data are not available yet. Upgrade to 1.123.85, 2.43.5 or 2.44.1 or later, then rotate credentials that members without access could have reached, and review execution logs for inline sub-workflows that use credential IDs.
Is CVE-2026-118642 actively exploited?
No confirmed active exploitation of CVE-2026-118642 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-118642?
1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Until patched, restrict member accounts to trusted users and remove unneeded member access, especially on instances with sensitive credentials. 3) Rotate credentials that were stored in affected instances, prioritizing LLM API keys, cloud and database secrets. 4) Review workflows and execution history for Execute Workflow nodes in inline JSON mode, 'disabled' fields with non-boolean values, and outbound HTTP calls to unfamiliar hosts. 5) Apply egress filtering on the n8n host to limit calls to unapproved destinations. 6) Monitor audit logs for credential use by users who are not credential owners or sharees.
What systems are affected by CVE-2026-118642?
This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow automation platforms, LLM orchestration pipelines, RAG pipelines, multi-tenant AI automation.
What is the CVSS score for CVE-2026-118642?
CVE-2026-118642 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.21%.
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0012Valid AccountsAML.T0025Exfiltration via Cyber MeansAML.T0083Credentials from AI Agent ConfigurationAML.T0098AI Agent Tool Credential HarvestingAML.T0106Exploitation for Credential AccessCompliance Controls Affected
What are the technical details?
Original Advisory
n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated members to use inaccessible credentials through inline sub-workflow nodes with non-boolean disabled values. Attackers knowing a credential id can run Execute Workflow nodes in inline JSON mode that skip the permission check and send decrypted credentials to attacker-controlled servers.
Exploitation Scenario
An attacker holds a low-privilege member account on a company's shared n8n instance, or has compromised one, and learns the ID of an OpenAI or cloud credential used by another team's agent workflows (for example from URLs, exported workflows or error messages). They build a workflow with an Execute Workflow node in inline JSON mode, set the 'disabled' property to a non-boolean value so the permission check is skipped, and point the sub-workflow nodes at that credential ID with an HTTP request to a server they control. When the workflow runs, n8n decrypts the credential and sends it out. The attacker then uses the stolen key to access models, vector stores or cloud resources, or drives up LLM costs.
Weaknesses (CWE)
CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:NReferences
Timeline
Related Vulnerabilities
CVE-2026-3366310.0n8n: member role steals plaintext HTTP credentials
Same package: n8nCVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same package: n8nCVE-2026-2185810.0n8n: Input Validation flaw enables exploitation
Same package: n8nCVE-2026-275779.9n8n: Code Injection enables RCE
Same package: n8nCVE-2026-274949.9n8n: security flaw enables exploitation
Same package: n8n