n8n: Shared-Workflow Credential Check Misses Nested and Tool Inline Sub-Workflows

Impact

On the version 1.x, the save-time check that stops a shared-workflow editor introducing credentials they are not allowed to use inspected only one node type, one level deep. Two other nodes also accept an inline workflow in their parameters, and inline workflows can nest. An editor can therefore save a workflow whose embedded nodes reference credentials they have no access to; at execution those nodes run with the owner's credential values.

Patches

The issue has been fixed in n8n version 1.123.83. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Audit shared workflows for Workflow Tool or Workflow Retriever nodes that use an inline workflow definition and verify that any referenced credentials are accessible to all users with edit access to that workflow.
• Restrict workflow sharing to the minimum set of users required until the instance is patched.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.