CVE-2026-85166Medium· 6.5▾ Sunlitn8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node). A shared-workflow editor, or any user creating/up…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
6.5 → —
medium → none
— → 6.5
none → medium
6.5 → —
medium → none
— → 6.5
none → medium
6.5 → —
medium → none
— → 6.5
none → medium
n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node). A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can persist a node referencing a credential they do not own. When the workflow is later executed under an identity that holds the credential, the inline sub-workflow resolves the secret and can send it to an attacker-controlled endpoint, resulting in credential exfiltration.
n8n < 2.35.4n8n >= 2.36.0, < 2.36.2Upgrade past the affected range:
n8n 2.36.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-86073High· 7.6n8n is an open source workflow automation platform
GHSA-5vfw-jc4p-fj39MediumDuplicate Advisory: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check
GHSA-88c4-pcqm-3r9pMediumDuplicate Advisory: GraphQL Node Bypasses "Allowed HTTP Request Domains" Restriction
GHSA-6qc9-mqvw-jg7xHighn8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
GHSA-cj9h-qx8g-pq2gHighn8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
CVE-2026-65594Mediumn8n: Member-Level Users Can Execute Other Users' MCP Server Trigger Workflows via Missing OAuth Authorization Check