CVE-2026-110844GHSA-r6g9-5cpp-ppwr
n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows
n8n-io n8nFrameworks
CVSS
7.2HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.28%Chance of exploitation activity in the next 30 days, higher than 19% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 1.123.83n8nCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.
Text from CVE List
Affected versions 1
- n8naffected: all versions before 1.123.83CVE List