{"id":"GHSA-8crx-5h96-q72q","kind":"vulnerability","aliases":["GHSA-8crx-5h96-q72q"],"related":[],"title":"Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard","description":"## Impact\n\nWhen a workflow is shared for editing, n8n checks on save that the editor does not add credentials they may not use. The Execute Sub-workflow node can load its sub-workflow from a URL or a local file at run time, and the check never saw that content. An editor of a shared workflow can therefore have credentials of the workflow's project resolved by a sub-workflow they serve, and receive the decrypted values.\n\n## Patches\n\nThe issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Audit shared workflows for Execute Sub-workflow nodes using `source: url` or `source: localFile` parameters and remove or restrict them.\n- Remove editor access from any users who are not fully trusted until the instance is patched.\n- Apply network-level controls to prevent the n8n process from reaching attacker-controlled infrastructure if outbound HTTP cannot be fully restricted.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"n8n's save-time check on shared workflows does not inspect sub-workflows that the Execute Sub-workflow node loads from a URL or local file at run time. An editor of a shared workflow can therefore get credentials from the owning project resolved and receive their decrypted values.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 1.123.85"],"affected":"< 1.123.85","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.44.1"],"affected":"< 2.44.1","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.43.5"],"affected":"< 2.43.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","credentials","n8n","self-hosted"],"not_affected_if":["fully-trusted-editors","no-shared-workflows","single-owner-instance"],"how_to_check":"- Check the n8n version with `n8n --version` or the image tag; affected versions are below `1.123.85` on the 1.x line, below `2.43.5` on the 2.43 line, and below `2.44.1` on the 2.44 line.\n- Search shared workflows for Execute Sub-workflow nodes with `source: url` or `source: localFile`.","fix":"- n8n `1.123.85`\n- n8n `2.43.5`\n- n8n `2.44.1`","status":"open","published_at":"2026-10-14T09:43:53+00:00","first_seen_at":"2026-11-09T22:53:26+00:00","triaged_at":"2026-11-09T22:56:56+00:00","updated_at":"2026-11-09T22:56:56+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:56:56Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `1.123.85`\n- n8n `2.43.5`\n- n8n `2.44.1`","reach":"network","title":"n8n: shared-workflow credential guard bypassed by Execute Sub-workflow URL or file","impact":"high","summary":"n8n's save-time check on shared workflows does not inspect sub-workflows that the Execute Sub-workflow node loads from a URL or local file at run time. An editor of a shared workflow can therefore get credentials from the owning project resolved and receive their decrypted values.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","credentials"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Editors of shared workflows read decrypted credentials from the owning project","analyst_note":"","how_to_check":"- Check the n8n version with `n8n --version` or the image tag; affected versions are below `1.123.85` on the 1.x line, below `2.43.5` on the 2.43 line, and below `2.44.1` on the 2.44 line.\n- Search shared workflows for Execute Sub-workflow nodes with `source: url` or `source: localFile`.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-owner-instance","no-shared-workflows","fully-trusted-editors"],"who_is_affected":"Self-hosted or cloud n8n instances that share workflows with editors who are not fully trusted, and where a shared workflow contains an Execute Sub-workflow node that loads its sub-workflow from a URL or local file. Instances where every editor is fully trusted, or that do not share workflows, are less exposed.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000812,"input_tokens":5002,"output_tokens":624,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'1.123.85':177C '2.43.5':180C '2.44.1':178C '5h96':18A,23A '8crx':17A,22A 'access':212C,241C 'add':105C 'administr':202C 'ai':29B 'ai-tool':28B 'appli':255C 'attack':268C 'attacker-control':267C 'audit':218C 'bypass':9A 'cannot':274C 'check':41B,97C,135C 'consid':204C 'content':139C 'control':259C,269C 'credenti':13A,31B,77B,106C,149C 'decrypt':86B,166C 'edit':95C 'editor':69B,102C,141C,240C 'execut':1A,53B,112C,222C 'file':64B,129C 'fix':173C 'follow':206C 'fulli':214C,248C,276C,282C 'get':76B 'ghsa':16A,21A 'ghsa-8crx-5h96-q72q':15A,20A 'guard':14A 'host':35B 'http':273C 'immedi':200C 'impact':88C 'infrastructur':270C 'inspect':47B 'instanc':211C,252C 'issu':170C 'later':190C 'level':258C 'load':58B,118C 'local':63B,128C 'localfil':8A,232C 'may':108C 'measur':296C 'mitig':208C,295C 'n8n':25A,26A,27A,32B,36B,96C,175C,210C,263C 'network':257C 'network-level':256C 'never':136C 'node':57B,116C,226C 'one':185C 'outbound':272C 'own':80B 'paramet':233C 'patch':168C,254C 'possibl':201C 'prevent':261C 'process':264C 'project':81B,154C 'q72q':19A,24A 'reach':266C 'receiv':84B,164C 'remedi':192C,283C 'remov':235C,239C 'resolv':82B,155C 'restrict':209C,237C,277C 'risk':285C 'run':66B,131C 'save':39B,99C 'save-tim':38B 'saw':137C 'self':34B 'self-host':33B 'serv':162C 'share':11A,43B,72B,93C,144C,219C 'shared-workflow':10A 'short':293C 'short-term':292C 'sourc':5A,7A,228C,231C 'sub':3A,49B,55B,114C,121C,159C,224C 'sub-workflow':2A,48B,54B,113C,120C,158C,223C 'temporari':207C 'term':294C 'therefor':75B,147C 'time':40B,67B,132C 'tool':30B 'trust':215C,249C 'upgrad':183C,197C 'url':6A,61B,125C,229C 'use':110C,227C,290C 'user':181C,216C,244C 'valu':87B,167C 'version':176C,188C 'vulner':194C 'workaround':195C,279C 'workflow':4A,12A,44B,50B,56B,73B,91C,115C,122C,145C,152C,160C,220C,225C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted or cloud n8n instances that share workflows with editors who are not fully trusted, and where a shared workflow contains an Execute Sub-workflow node that loads its sub-workflow from a URL or local file. Instances where every editor is fully trusted, or that do not share workflows, are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["aitooling","credentials","medium","n8n","npm","selfhosted"],"campaign_type":null,"search_a":"'5h96':18A,23A '8crx':17A,22A 'bypass':9A 'credenti':13A 'execut':1A 'ghsa':16A,21A 'ghsa-8crx-5h96-q72q':15A,20A 'guard':14A 'localfil':8A 'n8n':25A,26A,27A 'q72q':19A,24A 'share':11A 'shared-workflow':10A 'sourc':5A,7A 'sub':3A 'sub-workflow':2A 'url':6A 'workflow':4A,12A","search_b":"'ai':29B 'ai-tool':28B 'check':41B 'credenti':31B,77B 'decrypt':86B 'editor':69B 'execut':53B 'file':64B 'get':76B 'host':35B 'inspect':47B 'load':58B 'local':63B 'n8n':32B,36B 'node':57B 'own':80B 'project':81B 'receiv':84B 'resolv':82B 'run':66B 'save':39B 'save-tim':38B 'self':34B 'self-host':33B 'share':43B,72B 'sub':49B,55B 'sub-workflow':48B,54B 'therefor':75B 'time':40B,67B 'tool':30B 'url':61B 'valu':87B 'workflow':44B,50B,56B,73B","search_c":"'1.123.85':177C '2.43.5':180C '2.44.1':178C 'access':212C,241C 'add':105C 'administr':202C 'appli':255C 'attack':268C 'attacker-control':267C 'audit':218C 'cannot':274C 'check':97C,135C 'consid':204C 'content':139C 'control':259C,269C 'credenti':106C,149C 'decrypt':166C 'edit':95C 'editor':102C,141C,240C 'execut':112C,222C 'file':129C 'fix':173C 'follow':206C 'fulli':214C,248C,276C,282C 'http':273C 'immedi':200C 'impact':88C 'infrastructur':270C 'instanc':211C,252C 'issu':170C 'later':190C 'level':258C 'load':118C 'local':128C 'localfil':232C 'may':108C 'measur':296C 'mitig':208C,295C 'n8n':96C,175C,210C,263C 'network':257C 'network-level':256C 'never':136C 'node':116C,226C 'one':185C 'outbound':272C 'paramet':233C 'patch':168C,254C 'possibl':201C 'prevent':261C 'process':264C 'project':154C 'reach':266C 'receiv':164C 'remedi':192C,283C 'remov':235C,239C 'resolv':155C 'restrict':209C,237C,277C 'risk':285C 'run':131C 'save':99C 'saw':137C 'serv':162C 'share':93C,144C,219C 'short':293C 'short-term':292C 'sourc':228C,231C 'sub':114C,121C,159C,224C 'sub-workflow':113C,120C,158C,223C 'temporari':207C 'term':294C 'therefor':147C 'time':132C 'trust':215C,249C 'upgrad':183C,197C 'url':125C,229C 'use':110C,227C,290C 'user':181C,216C,244C 'valu':167C 'version':176C,188C 'vulner':194C 'workaround':195C,279C 'workflow':91C,115C,122C,145C,152C,160C,220C,225C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-14T09:43:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-8crx-5h96-q72q","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-8crx-5h96-q72q","severity":"medium","published_at":"2026-10-14T09:43:53+00:00","modified_at":"2026-10-14T09:43:53+00:00","first_seen_at":"2026-11-09T22:53:26+00:00","fetched_at":"2026-11-09T22:53:26+00:00","note":null}],"documents":[{"id":48856,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-8crx-5h96-q72q","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-14T09:43:53+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}