CVE-2026-110844
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow…
- Risk score
- 47/100
- CVSS
- 7.2 v4.0
- Exploit chance (30 days)
- 0.3%
- Published
- 14 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credenti…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.123.83 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 7.2 high
References
Original description
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values.
Last activity 14 Oct 2026. Patch Forecast updates every hour.