CVE-2026-118675: n8n credential guard bypass

CISO Take

CVE-2026-118675 lets a low-privileged editor of a shared n8n workflow bypass the credential guard and read the decrypted values of restricted project credentials, simply by pointing the Execute Sub-workflow node at a URL or local file source. This matters because n8n is a common orchestration layer for AI agents and typically stores the highest-value secrets in the organization, such as LLM provider API keys, vector database tokens, and SaaS OAuth credentials. Exploitation is rated high complexity, and there is no public exploit, no Nuclei template, no CISA KEV listing and no EPSS score yet, so near-term mass exploitation looks unlikely. The scope change in the CVSS vector (S:C) and the high confidentiality impact still make this a serious insider-threat and privilege-boundary issue for multi-user instances. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 or later, audit who holds editor rights on shared workflows, and rotate any credentials that were exposed to editors who should not have had access.

Sources:NVDGitHub Advisoryvulncheck.comATLAS

What is the risk?

Overall risk is HIGH (CVSS 7.1) but bounded by preconditions. The attacker needs an authenticated account with editor rights on a shared workflow (PR:L) and must exploit a high-complexity condition (AC:H), which is a meaningful barrier. No public exploit, no scanner template, no KEV listing and no EPSS data are available, so exploitation likelihood is currently low to moderate. Impact is high for confidentiality because decrypted credentials are returned, with limited integrity impact, and the changed scope means the compromise extends beyond the workflow to every system those credentials unlock. Risk is highest on multi-tenant or multi-team n8n instances where credential restrictions are the primary segregation control.

How does the attack unfold?

Initial Access

The attacker uses a valid editor account on a shared n8n workflow with no access to restricted project credentials.

AML.T0012

Exploitation

The attacker configures an Execute Sub-workflow node with source url or localFile so the credential guard is bypassed.

AML.T0106

Credential Access

The served sub-workflow resolves restricted project credentials and returns their decrypted values in the output.

AML.T0083

Impact

The attacker reuses stolen LLM, database and SaaS credentials to access data and abuse connected AI and cloud services.

AML.T0098

Initial Access

The attacker uses a valid editor account on a shared n8n workflow with no access to restricted project credentials.

AML.T0012

Exploitation

The attacker configures an Execute Sub-workflow node with source url or localFile so the credential guard is bypassed.

AML.T0106

Credential Access

The served sub-workflow resolves restricted project credentials and returns their decrypted values in the output.

AML.T0083

Impact

The attacker reuses stolen LLM, database and SaaS credentials to access data and abuse connected AI and cloud services.

AML.T0098

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
208.5KOpenSSF 7.116 dependentsPushed 7d ago44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

7.1 / 10

EPSS

0.2%

chance of exploitation in 30 days

Higher than 6% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SChanged

CHigh

ILow

ANone

What should I do?

1 step

1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Until patched, restrict editor permissions on shared workflows to trusted users and remove unnecessary shared access to workflows that sit next to sensitive projects. 3) Disable or restrict the ability to load sub-workflows from URLs and local files if the deployment allows it, and block outbound access from n8n to untrusted hosts. 4) Review workflows for Execute Sub-workflow nodes using source url or localFile that were created or modified by non-owners. 5) Rotate credentials in projects where untrusted editors had access, especially LLM provider keys and cloud tokens. 6) Monitor n8n audit and execution logs for unexpected sub-workflow sources, plus provider-side logs for unusual use of rotated or exposed keys.

How is it classified?

Auth BypassData LeakageAgentFrameworkAML.T0012- Valid Accounts AML.T0083- Credentials from AI Agent Configuration AML.T0098- AI Agent Tool Credential Harvesting AML.T0106- Exploitation for Credential Access

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Responding to unknown risks and mechanisms for disengagement

OWASP LLM Top 10

LLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-118675?

CVE-2026-118675 lets a low-privileged editor of a shared n8n workflow bypass the credential guard and read the decrypted values of restricted project credentials, simply by pointing the Execute Sub-workflow node at a URL or local file source. This matters because n8n is a common orchestration layer for AI agents and typically stores the highest-value secrets in the organization, such as LLM provider API keys, vector database tokens, and SaaS OAuth credentials. Exploitation is rated high complexity, and there is no public exploit, no Nuclei template, no CISA KEV listing and no EPSS score yet, so near-term mass exploitation looks unlikely. The scope change in the CVSS vector (S:C) and the high confidentiality impact still make this a serious insider-threat and privilege-boundary issue for multi-user instances. Upgrade to n8n 1.123.85, 2.43.5 or 2.44.1 or later, audit who holds editor rights on shared workflows, and rotate any credentials that were exposed to editors who should not have had access.

Is CVE-2026-118675 actively exploited?

No confirmed active exploitation of CVE-2026-118675 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-118675?

1) Upgrade n8n to 1.123.85, 2.43.5, 2.44.1 or later. 2) Until patched, restrict editor permissions on shared workflows to trusted users and remove unnecessary shared access to workflows that sit next to sensitive projects. 3) Disable or restrict the ability to load sub-workflows from URLs and local files if the deployment allows it, and block outbound access from n8n to untrusted hosts. 4) Review workflows for Execute Sub-workflow nodes using source url or localFile that were created or modified by non-owners. 5) Rotate credentials in projects where untrusted editors had access, especially LLM provider keys and cloud tokens. 6) Monitor n8n audit and execution logs for unexpected sub-workflow sources, plus provider-side logs for unusual use of rotated or exposed keys.

What systems are affected by CVE-2026-118675?

This vulnerability affects the following AI/ML architecture patterns: Agent frameworks, Workflow automation platforms, RAG pipelines, LLM API integrations, Multi-tenant AI orchestration.

What is the CVSS score for CVE-2026-118675?

CVE-2026-118675 has a CVSS v3.1 base score of 7.1 (HIGH). The EPSS exploitation probability is 0.17%.

What is the AI security impact?

Affected AI Architectures

Agent frameworksWorkflow automation platformsRAG pipelinesLLM API integrationsMulti-tenant AI orchestration

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0083Credentials from AI Agent Configuration

AML.T0098AI Agent Tool Credential Harvesting

AML.T0106Exploitation for Credential Access

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared workflows to use restricted credentials by loading sub-workflows from URLs or local files. Attackers can configure the Execute Sub-workflow node with source url or localFile to serve content that resolves project credentials and returns their decrypted values.

Exploitation Scenario

A contractor with editor rights on a shared n8n workflow in an AI operations team wants access to the LLM and vector database credentials held in a restricted project. They add an Execute Sub-workflow node, set its source to url, and host a crafted workflow definition that references the restricted credentials. When the node runs, the credential guard is skipped and the resolved decrypted values come back in the execution output. The attacker copies the keys, then uses them outside n8n to run expensive LLM queries, read embedded corporate documents from the vector store, or pivot into connected SaaS accounts.

Weaknesses (CWE)

CWE-863Incorrect AuthorizationPrimary CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.