{"schema":"threatline.record/2","record":{"id":"GHSA-8vrr-mgc5-jg55","aliases":["GHSA-8vrr-mgc5-jg55"],"summary":"Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value","details":"## Impact\n\nBefore a workflow runs, n8n checks that the user may use each credential its nodes reference. The check and the execution engine decided in different ways whether a node is disabled, so a node inside an inline sub-workflow could be skipped by the check and still run. A member who knows the id of a credential they have no access to can run such a node and send the decrypted credential to a server they control.\n\n## Patches\n\nThe issue has been fixed in n8n versions 1.123.85, 2.43.5, and 2.44.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\n\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict n8n instance access to fully trusted users only.\n- Audit execution logs for unexpected successful executions of Execute Workflow nodes using inline JSON mode.\n- Remove member access from any users who are not fully trusted until the instance is patched.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","categories":["Frameworks"],"product":"n8n","vendor":"","ecosystem":null,"affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-8vrr-mgc5-jg55","source_modified_at":"2026-10-14T09:44:07Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 1.123.85"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-8vrr-mgc5-jg55","source_modified_at":"2026-10-14T09:44:07Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.44.1"},{"source":"GitHub Advisory Database","source_url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-8vrr-mgc5-jg55","source_modified_at":"2026-10-14T09:44:07Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"npm","name":"n8n"},"range":"< 2.43.5"}],"fixed_versions":[],"cvss":5.1,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-14T09:44:07Z","modified_at":"2026-10-14T09:44:07Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-8vrr-mgc5-jg55","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-14T09:44:07Z"}],"sources":["GitHub Advisory Database"],"references":[],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-14T09:44:07Z","content_hash":"2bdc350422d9de4878518ed6e038251d699b3d18e68c8b8cc40b8eaa8a8cdfec"}}