CVE-2026-72763

n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow when workflow sharing is enabled who knows a...

EUVD-2026-56142

n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow when workflow sharing is enabled who knows a...

CVE-2026-72763 n8n before 1.123.67 Credential Exfiltration via Sub-Workflow

n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow when workflow sharing is enabled who knows a...

CVE-2026-72763: Authorization Bypass Through User-Controlled Key

n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow when workflow sharing is enabled who knows a...

Incorrect Authorization

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Incorrect Authorization via the Execute Sub-workflow. An attacker can access unauthorized credentials by referencing credential IDs within inline workflow JSON, bypassing intended access controls. Note: Thi...

PT-2026-67358

Impact n8n's credential-access checks validated only a node's top-level credentials, not credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with editor access to a shared workflow could reference a credential they were not permitted to use inside that inli...