CVE-2026-72763
n8n before 1.123.67 Credential Exfiltration via Sub-Workflow
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow (when workflow sharing is enabled) who knows a target credential's ID can reference that credential in the inline JSON; it passes save-time and runtime validation and resolves in the parent workflow's project context, allowing the attacker to use or exfiltrate credentials they are not permitted to access.
| CWE | CWE-639 |
| Vendor | n8n-io |
| Product | n8n |
| Published | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for n8n-io n8n
Be the first to know when new unknown vulnerabilities affecting n8n-io n8n are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n8n-io / n8n
0 < 1.123.67
n8n-io / n8n
0 < 2.32.1
n8n-io / n8n
0 < 2.31.5
References
Credits
🔍 nlgbao1340