{"id":"GHSA-8vrr-mgc5-jg55","kind":"vulnerability","aliases":["GHSA-8vrr-mgc5-jg55"],"related":[],"title":"Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value","description":"## Impact\n\nBefore a workflow runs, n8n checks that the user may use each credential its nodes reference. The check and the execution engine decided in different ways whether a node is disabled, so a node inside an inline sub-workflow could be skipped by the check and still run. A member who knows the id of a credential they have no access to can run such a node and send the decrypted credential to a server they control.\n\n## Patches\n\nThe issue has been fixed in n8n versions 1.123.85, 2.43.5, and 2.44.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Audit execution logs for unexpected successful executions of Execute Workflow nodes using inline JSON mode.\n- Remove member access from any users who are not fully trusted until the instance is patched.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","summary":"n8n checks credential access before a workflow runs, but a node inside an inline sub-workflow with a non-boolean disabled value can be skipped by that check while still executing. A member who knows the id of a credential they cannot access can run such a node and send the decrypted credential to a server they control.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"n8n","fixed":[">= 1.123.85"],"affected":"< 1.123.85","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.44.1"],"affected":"< 2.44.1","ecosystem":"npm"},{"name":"n8n","fixed":[">= 2.43.5"],"affected":"< 2.43.5","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["ai-tooling","n8n","self-hosted","workflow-automation"],"not_affected_if":["managed-hosting-patched","single-user-instance"],"how_to_check":"- Check the installed n8n version with `n8n --version` or the `n8n` entry in package.json; versions below `1.123.85`, `2.43.5` or `2.44.1` on their respective lines are affected.\n- Review execution logs for successful runs of Execute Workflow nodes using inline JSON mode that were not expected.","fix":"- n8n `1.123.85`\n- n8n `2.43.5`\n- n8n `2.44.1`","status":"open","published_at":"2026-10-14T09:44:07+00:00","first_seen_at":"2026-11-09T22:53:26+00:00","triaged_at":"2026-11-09T22:56:54+00:00","updated_at":"2026-11-09T22:56:54+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-11-09T22:56:54Z","model":"claude-haiku-5-5","output":{"fix":"- n8n `1.123.85`\n- n8n `2.43.5`\n- n8n `2.44.1`","reach":"network","title":"n8n: credential check skips disabled sub-workflow nodes, leaking stored credentials","impact":"high","summary":"n8n checks credential access before a workflow runs, but a node inside an inline sub-workflow with a non-boolean disabled value can be skipped by that check while still executing. A member who knows the id of a credential they cannot access can run such a node and send the decrypted credential to a server they control.","audience":"businesses","category":"ai-tooling","nicknames":[],"who_cares":["n8n","self-hosted","workflow-automation"],"confidence":0.8,"fix_status":"available","needs_auth":"yes","worst_case":"Member runs a node that exfiltrates decrypted credentials to an attacker server.","analyst_note":"","how_to_check":"- Check the installed n8n version with `n8n --version` or the `n8n` entry in package.json; versions below `1.123.85`, `2.43.5` or `2.44.1` on their respective lines are affected.\n- Review execution logs for successful runs of Execute Workflow nodes using inline JSON mode that were not expected.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["single-user-instance","managed-hosting-patched"],"who_is_affected":"Self-hosted n8n instances with multiple users who have member access, where workflows use inline sub-workflows (Execute Workflow nodes in inline JSON mode) and credentials are stored. Instances used only by fully trusted users have a lower practical risk, though the advisory still recommends upgrading.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000804,"input_tokens":4929,"output_tokens":623,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'1.123.85':188C '2.43.5':189C '2.44.1':191C '8vrr':19A,24A 'access':43B,84B,162C,223C,246C 'administr':213C 'ai':31B 'ai-tool':30B 'audit':229C 'autom':39B 'boolean':14A,61B 'cannot':83B 'check':3A,41B,69B,106C,118C,146C 'consid':215C 'control':99B,178C 'could':141C 'credenti':1A,42B,81B,94B,113C,158C,173C 'decid':123C 'decrypt':93B,172C 'differ':125C 'disabl':15A,62B,131C 'engin':122C 'execut':72B,121C,230C,235C,237C 'fix':184C 'follow':217C 'fulli':225C,253C,264C 'ghsa':18A,23A 'ghsa-8vrr-mgc5-jg55':17A,22A 'host':36B 'id':78B,155C 'immedi':211C 'impact':100C 'inlin':5A,53B,137C,241C 'insid':51B,135C 'instanc':222C,257C 'issu':181C 'jg55':21A,26A 'json':242C 'know':76B,153C 'later':201C 'log':231C 'may':110C 'measur':278C 'member':74B,151C,245C 'mgc5':20A,25A 'mitig':219C,277C 'mode':243C 'n8n':27A,28A,29A,33B,40B,105C,186C,221C 'node':9A,50B,89B,115C,129C,134C,168C,239C 'non':13A,60B 'non-boolean':12A,59B 'one':196C 'patch':179C,259C 'permiss':2A 'possibl':212C 'refer':116C 'remedi':203C,265C 'remov':244C 'restrict':220C 'risk':267C 'run':47B,86B,104C,149C,165C 'self':35B 'self-host':34B 'send':91B,170C 'server':97B,176C 'short':275C 'short-term':274C 'skip':4A,66B,143C 'still':71B,148C 'sub':7A,55B,139C 'sub-workflow':6A,54B,138C 'success':234C 'temporari':218C 'term':276C 'tool':32B 'trust':226C,254C 'unexpect':233C 'upgrad':194C,208C 'use':111C,240C,272C 'user':109C,192C,227C,249C 'valu':16A,63B 'version':187C,199C 'vulner':205C 'way':126C 'whether':127C 'workaround':206C,261C 'workflow':8A,38B,46B,56B,103C,140C,238C 'workflow-autom':37B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted n8n instances with multiple users who have member access, where workflows use inline sub-workflows (Execute Workflow nodes in inline JSON mode) and credentials are stored. Instances used only by fully trusted users have a lower practical risk, though the advisory still recommends upgrading.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["n8n"],"ptokens":["n8n"],"labels":["aitooling","medium","n8n","npm","selfhosted","workflowautomation"],"campaign_type":null,"search_a":"'8vrr':19A,24A 'boolean':14A 'check':3A 'credenti':1A 'disabl':15A 'ghsa':18A,23A 'ghsa-8vrr-mgc5-jg55':17A,22A 'inlin':5A 'jg55':21A,26A 'mgc5':20A,25A 'n8n':27A,28A,29A 'node':9A 'non':13A 'non-boolean':12A 'permiss':2A 'skip':4A 'sub':7A 'sub-workflow':6A 'valu':16A 'workflow':8A","search_b":"'access':43B,84B 'ai':31B 'ai-tool':30B 'autom':39B 'boolean':61B 'cannot':83B 'check':41B,69B 'control':99B 'credenti':42B,81B,94B 'decrypt':93B 'disabl':62B 'execut':72B 'host':36B 'id':78B 'inlin':53B 'insid':51B 'know':76B 'member':74B 'n8n':33B,40B 'node':50B,89B 'non':60B 'non-boolean':59B 'run':47B,86B 'self':35B 'self-host':34B 'send':91B 'server':97B 'skip':66B 'still':71B 'sub':55B 'sub-workflow':54B 'tool':32B 'valu':63B 'workflow':38B,46B,56B 'workflow-autom':37B","search_c":"'1.123.85':188C '2.43.5':189C '2.44.1':191C 'access':162C,223C,246C 'administr':213C 'audit':229C 'check':106C,118C,146C 'consid':215C 'control':178C 'could':141C 'credenti':113C,158C,173C 'decid':123C 'decrypt':172C 'differ':125C 'disabl':131C 'engin':122C 'execut':121C,230C,235C,237C 'fix':184C 'follow':217C 'fulli':225C,253C,264C 'id':155C 'immedi':211C 'impact':100C 'inlin':137C,241C 'insid':135C 'instanc':222C,257C 'issu':181C 'json':242C 'know':153C 'later':201C 'log':231C 'may':110C 'measur':278C 'member':151C,245C 'mitig':219C,277C 'mode':243C 'n8n':105C,186C,221C 'node':115C,129C,134C,168C,239C 'one':196C 'patch':179C,259C 'possibl':212C 'refer':116C 'remedi':203C,265C 'remov':244C 'restrict':220C 'risk':267C 'run':104C,149C,165C 'send':170C 'server':176C 'short':275C 'short-term':274C 'skip':143C 'still':148C 'sub':139C 'sub-workflow':138C 'success':234C 'temporari':218C 'term':276C 'trust':226C,254C 'unexpect':233C 'upgrad':194C,208C 'use':111C,240C,272C 'user':109C,192C,227C,249C 'version':187C,199C 'vulner':205C 'way':126C 'whether':127C 'workaround':206C,261C 'workflow':103C,140C,238C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-14T09:44:07+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-8vrr-mgc5-jg55","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-8vrr-mgc5-jg55","severity":"medium","published_at":"2026-10-14T09:44:07+00:00","modified_at":"2026-10-14T09:44:07+00:00","first_seen_at":"2026-11-09T22:53:26+00:00","fetched_at":"2026-11-09T22:53:26+00:00","note":null}],"documents":[{"id":48840,"url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-8vrr-mgc5-jg55","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-14T09:44:07+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}