---
id: "GHSA-8crx-5h96-q72q"
page: "https://infrastack.ai/live/GHSA-8crx-5h96-q72q"
kind: "vulnerability"
aliases: ["GHSA-8crx-5h96-q72q"]
title: "Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "n8n", "fixed": [">= 1.123.85"], "affected": "< 1.123.85", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.44.1"], "affected": "< 2.44.1", "ecosystem": "npm"}, {"name": "n8n", "fixed": [">= 2.43.5"], "affected": "< 2.43.5", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["ai-tooling", "credentials", "n8n", "self-hosted"]
not_affected_if: ["fully-trusted-editors", "no-shared-workflows", "single-owner-instance"]
published_at: "2026-10-14T09:43:53+00:00"
first_seen_at: "2026-11-09T22:53:26+00:00"
updated_at: "2026-11-09T22:56:56+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-8crx-5h96-q72q", "first_seen_at": "2026-11-09T22:53:26+00:00"}]
exploit_sources: []
---

# Execute Sub-workflow `source: url` / `source: localFile` Bypasses Shared-Workflow Credential Guard

Link for people: https://infrastack.ai/live/GHSA-8crx-5h96-q72q (this .md is for agents)

n8n's save-time check on shared workflows does not inspect sub-workflows that the Execute Sub-workflow node loads from a URL or local file at run time. An editor of a shared workflow can therefore get credentials from the owning project resolved and receive their decrypted values.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:n8n affected < 1.123.85 fixed >= 1.123.85
- npm:n8n affected < 2.44.1 fixed >= 2.44.1
- npm:n8n affected < 2.43.5 fixed >= 2.43.5

## How to check

- Check the n8n version with `n8n --version` or the image tag; affected versions are below `1.123.85` on the 1.x line, below `2.43.5` on the 2.43 line, and below `2.44.1` on the 2.44 line.
- Search shared workflows for Execute Sub-workflow nodes with `source: url` or `source: localFile`.

## Fix

- n8n `1.123.85`
- n8n `2.43.5`
- n8n `2.44.1`

## Timeline

- 2026-11-09T22:53:26+00:00 ghsa-repo https://github.com/n8n-io/n8n/security/advisories/GHSA-8crx-5h96-q72q

## Documents

- [advisory] Vendor advisory: github.com https://github.com/n8n-io/n8n/security/advisories/GHSA-8crx-5h96-q72q

## From the sources

## Impact

When a workflow is shared for editing, n8n checks on save that the editor does not add credentials they may not use. The Execute Sub-workflow node can load its sub-workflow from a URL or a local file at run time, and the check never saw that content. An editor of a shared workflow can therefore have credentials of the workflow's project resolved by a sub-workflow they serve, and receive the decrypted values.

## Patches

The issue has been fixed in n8n versions 1.123.85, 2.44.1, and 2.43.5. Users should upgrade to one of these versions or later to remediate the vulnerability.

## Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Audit shared workflows for Execute Sub-workflow nodes using `source: url` or `source: localFile` parameters and remove or restrict them.
- Remove editor access from any users who are not fully trusted until the instance is patched.
- Apply network-level controls to prevent the n8n process from reaching attacker-controlled infrastructure if outbound HTTP cannot be fully restricted.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_