Description
n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node). A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can persist a node referencing a credential they do not own. When the workflow is later executed under an identity that holds the credential, the inline sub-workflow resolves the secret and can send it to an attacker-controlled endpoint, resulting in credential exfiltration.
Published: 2026-09-03
Score: 7.2 High
EPSS: < 1% Very Low
KEV: No
Impact: Credential Exfiltration
Action: Immediate Patch
AI Analysis

Impact

A flaw in n8n versions before 2.36.2 allows crafted inline sub‑workflows to reference credentials that the workflow editor does not own. When such a workflow is executed under an identity that possesses the referenced credential, the sub‑workflow resolves the secret and can deliver it to an attacker‑controlled endpoint, leading to credential exfiltration. This flaw violates authorization controls and is classified under CWE‑863, exposing credentials to unauthorized parties.

Affected Systems

The vulnerability affects n8n‑io’s n8n product in all releases before 2.35.4 and before 2.36.2, including the 2.35.x series and the 2.36.0‑2.36.1 releases. Users running these versions who can edit or update shared workflows via the editor, API, or MCP are at risk.

Risk and Exploitability

The CVSS score of 7.2 signals moderate‑to‑high severity. EPSS data is unavailable, so the exact exploitation probability is unknown. The vulnerability is not listed in CISA KEV. The likely attack vector involves a user who can create or modify a shared workflow to reference a credential they do not own, then causing the workflow to run under an account that has that credential, enabling the sub‑workflow to resolve the secret and exfiltrate it to an attacker‑controlled endpoint.

Generated by OpenCVE AI on September 3, 2026 at 13:01 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade n8n to version 2.36.2 or later, which implements proper credential validation for inline sub‑workflows.
  • If an upgrade is not yet possible, limit the use of sensitive credentials in shared workflows by removing unauthorized credential references and restricting workflow execution permissions to trusted users only.
  • As a temporary workaround, audit existing workflows via the API to detect and delete nodes that reference credentials not owned by the workflow editor; re‑create workflows without malicious references.
  • Monitor outbound connections from n8n to external endpoints and review logs for activity matching known exfiltration patterns.

Generated by OpenCVE AI on September 3, 2026 at 13:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 10 Sep 2026 20:00:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:*
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}

Thu, 03 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 03 Sep 2026 11:30:00 +0000

Type Values Removed Values Added
Description n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node). A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can persist a node referencing a credential they do not own. When the workflow is later executed under an identity that holds the credential, the inline sub-workflow resolves the secret and can send it to an attacker-controlled endpoint, resulting in credential exfiltration.
Title n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node
First Time appeared N8n
N8n n8n
Weaknesses CWE-863
CPEs cpe:2.3:a:n8n:n8n:*:*:*:*:*:*:*:*
Vendors & Products N8n
N8n n8n
References
Metrics cvssV4_0

{'score': 7.2, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L'}

Subscriptions

N8n N8n
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-03T14:30:17.597Z

Reserved: 2026-09-03T11:05:09.078Z

Link: CVE-2026-85166

cve-icon Vulnrichment

Updated: 2026-09-03T14:05:19.995Z

cve-icon NVD

Status : Analyzed

Published: 2026-09-03T13:06:23.867

Modified: 2026-09-10T19:54:12.750

Link: CVE-2026-85166

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-03T15:30:05Z

Weaknesses