GHSA-cj9h-qx8g-pq2g: n8n — HIGH

Q: Is GHSA-cj9h-qx8g-pq2g actively exploited?

No confirmed active exploitation of GHSA-cj9h-qx8g-pq2g has been reported, but organizations should still patch proactively.

Q: How to fix GHSA-cj9h-qx8g-pq2g?

Update to patched version: n8n 1.123.67.

Q: What is the CVSS score for GHSA-cj9h-qx8g-pq2g?

No CVSS score has been assigned yet.

## Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with editor access to a shared workflow could reference a credential they were not permitted to use inside that...

Full CISO analysis pending enrichment.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.67	`1.123.67`
197.0K OpenSSF 6.6 16 dependents Pushed 4d ago 61% patched ~6d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

N/A

What should I do?

Patch available

Update n8n to version 1.123.67

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is GHSA-cj9h-qx8g-pq2g?

## Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with editor access to a shared workflow could reference a credential they were not permitted to use inside that inline JSON; it passed both save-time and runtime validation and resolved in the parent workflow's project context, letting the member use or exfiltrate a credential they could not otherwise access. Exploitation requires workflow sharing to be enabled and the attacker to have been explicitly granted Editor access to a shared workflow. The attacker must also know the target credential's ID. ## Patches The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow sharing to fully trusted users only, and avoid granting Editor access to untrusted members on workflows that use sensitive credentials. - Audit shared workflows for Execute Sub-workflow nodes with Source = "Parameter" and review their inline workflow definitions for unexpected credential references. - Restrict network egress from the n8n instance to prevent connections to attacker-controlled endpoints. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Is GHSA-cj9h-qx8g-pq2g actively exploited?

No confirmed active exploitation of GHSA-cj9h-qx8g-pq2g has been reported, but organizations should still patch proactively.

How to fix GHSA-cj9h-qx8g-pq2g?

Update to patched version: n8n 1.123.67.

What is the CVSS score for GHSA-cj9h-qx8g-pq2g?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

## Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with editor access to a shared workflow could reference a credential they were not permitted to use inside that inline JSON; it passed both save-time and runtime validation and resolved in the parent workflow's project context, letting the member use or exfiltrate a credential they could not otherwise access. Exploitation requires workflow sharing to be enabled and the attacker to have been explicitly granted Editor access to a shared workflow. The attacker must also know the target credential's ID. ## Patches The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow sharing to fully trusted users only, and avoid granting Editor access to untrusted members on workflows that use sensitive credentials. - Audit shared workflows for Execute Sub-workflow nodes with Source = "Parameter" and review their inline workflow definitions for unexpected credential references. - Restrict network egress from the n8n instance to prevent connections to attacker-controlled endpoints. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Weaknesses (CWE)

CWE-863 Incorrect Authorization Primary

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.