n8n: Execute Sub-workflow Inline JSON Allows Member to Spoof Workflow Identity for Credential Authorization, Static Data, and Error-Workflow Dispatch

Impact

Execute Sub-workflow's inline JSON mode carried an identifier that was then trusted as workflow metadata: it selected the project authorising the sub-workflow's credentials, the row receiving static data, and the workflow the run is recorded under. The party being authorised therefore supplied the identity the decision was made against. A member could have credentials resolved from a project they do not belong to and affect another workflow's stored state.

Patches

The issue has been fixed in n8n versions 1.123.83. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Audit and restrict membership to the minimum set of users who require access to the instance.
• Monitor execution logs for unexpected sub-workflow executions originating from webhook-triggered workflows owned by lower-privileged members.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.