Solidscripting

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 2.35.4 n8n versions 2.36.x prior to 2.36.2 **Description** Insufficient validation of credential references in the inline workflow JSON of nodes that execute inline sub-workflows, such as the Workflow Tool node, allows a shared-workflow editor or any user interacting via the REST API, Public API, or MCP to persist a node referencing a credential they do not own. If the workflow is executed by an identity that possesses the referenced credential, the inline sub-workflow can resolve the secret and transmit it to an external endpoint controlled by an attacker, leading to credential exfiltration. **Recommendations** Update n8n to version 2.35.4 or later. Update n8n versions 2.36.x to 2.36.2 or later.

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.55 n8n versions prior to 2.25.7 n8n versions prior to 2.26.2 **Description** Three Enterprise Edition endpoints used by the Dynamic Credentials feature fail to perform per-resource ownership or scope checks on target workflows or credentials. This allows an authenticated user, regardless of project membership or credential sharing permissions, to enumerate credential identifiers, names, and types referenced by any private workflow. Additionally, an attacker can initiate an OAuth authorization flow to overwrite another user's stored tokens with tokens from an account they control or revoke those tokens entirely. Consequently, workflows using hijacked credentials execute under the attacker's OAuth identity, potentially leading to data exfiltration to external services and persistent takeover of integrations. This issue specifically affects Enterprise instances with the Dynamic Credentials feature enabled. **Recommendations** Update to version 1.123.55. Update to version 2.25.7. Update to version 2.26.2. Restrict instance access to fully trusted users only. Disable the Dynamic Credentials feature by unsetting the `N8N ENV FEAT DYNAMIC CREDENTIALS` variable.