GHSA-cj9h-qx8g-pq2g: n8n: credential authz bypass via sub-workflow JSON

## Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with editor access to a shared workflow could reference a credential they were not permitted to use inside that inline JSON; it passed both save-time and runtime validation and resolved in the parent workflow's project context, letting the member use or exfiltrate a credential they could not otherwise access. Exploitation requires workflow sharing to be enabled and the attacker to have been explicitly granted Editor access to a shared workflow. The attacker must also know the target credential's ID. ## Patches The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow sharing to fully trusted users only, and avoid granting Editor access to untrusted members on workflows that use sensitive credentials. - Audit shared workflows for Execute Sub-workflow nodes with Source = "Parameter" and review their inline workflow definitions for unexpected credential references. - Restrict network egress from the n8n instance to prevent connections to attacker-controlled endpoints. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

A contractor or cross-team collaborator is granted Editor access to a shared n8n workflow that orchestrates a low-sensitivity AI agent task (e.g., a marketing content generator). Through prior access or workflow inspection, they learn the credential ID used by a separate, more sensitive workflow — say, the OpenAI API key tied to finance's automation, or a production vector database connection. They add an Execute Sub-workflow node to their own workflow, set Source to 'Parameter', and hand-craft the inline workflow JSON to reference that credential ID directly, bypassing the UI's normal credential picker. Because n8n only validated top-level node credentials and not those embedded in inline sub-workflow JSON, the reference passes save-time and runtime checks; on execution, n8n resolves the credential in the parent workflow's project context, letting the attacker route API calls through it (running up the victim's bill or accessing protected data) or add a follow-on node that forwards the resolved secret value to an attacker-controlled endpoint.