CVE-2026-72763

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.67 n8n versions prior to 2.31.5 n8n versions prior to 2.32.1

Description Insufficient validation of credential access occurs when using the Execute Sub-workflow node. The system only validates top-level credentials and fails to check credentials referenced within the inline workflow JSON. A user with Editor access to a shared workflow can reference a target credential ID within the inline JSON to bypass save-time and runtime validation. This allows the user to utilize or exfiltrate credentials from the parent workflow's project context that they are not authorized to access.

Recommendations Update to version 1.123.67 or later. Update to version 2.31.5 or later. Update to version 2.32.1 or later.