CVE-2026-110844 Details

A vulnerability in n8n versions prior to 1.123.83 allows shared-workflow editors to bypass authorization and use restricted credentials by embedding them in nested or tool inline sub-workflows. This issue arises because the authorization check only examines one node type, one level deep, enabling editors to save workflows that reference credentials they cannot access. When executed, these workflows use the credential values of the workflow owner, potentially leading to unauthorized access or actions.

Users should upgrade to n8n version 1.123.83 or later. If an immediate upgrade is not possible, administrators can restrict access to the n8n instance to trusted users, audit shared workflows for those using inline definitions that reference credentials, and limit workflow sharing to essential users until the instance is updated.