Alex Joseph
A significant security flaw has been discovered in n8n, a popular workflow automation tool. This vulnerability, identified as CVE-2026-72763, could allow an unauthorized editor to access or steal sensitive credentials. If you are using n8n, it is crucial to understand this risk and take immediate action to protect your systems.
At its core, the issue stems from how n8n handled credential access within its “Execute Sub-workflow” nodes. Previously, the system only checked for top-level credentials in a workflow. However, it failed to properly validate credentials referenced deep inside the JSON configuration of an inline sub-workflow. This oversight meant that an attacker with editor access to a shared workflow, and knowledge of a credential’s ID, could bypass security checks. They could embed a reference to a restricted credential within the sub-workflow’s JSON, allowing them to use or extract information they were not supposed to see.
CVE Details
- Product: n8n
- CVE ID: CVE-2026-72763
- Published: August 11, 2026
- Last Modified: October 23, 2026
- Severity: High (CVSS v4 Score: 7.2)
- Status: Analyzed
Affected Products
The vulnerability impacts versions of n8n prior to the following:
- n8n versions earlier than 1.123.67
- n8n versions earlier than 2.31.5
- n8n versions earlier than 2.32.1
Specifically, n8n versions including 2.32.0 and all versions represented by cpe:2.3:a:n8n:n8n:*:*:*:*:*:node.js:*:* are affected.
Current Status
This vulnerability has been officially analyzed. Patches have been released by the n8n development team to address the issue, and users are strongly advised to update their installations.
Severity Level
This vulnerability is rated as High severity with a CVSS v4 score of 7.2. The CVSS vector string is AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L. This indicates that the vulnerability can be exploited over a network with low attack complexity, requiring low privileges and no user interaction, leading to high confidentiality impact on the vulnerable system and high confidentiality and integrity impact on subsequent systems.
Possible Solutions
To mitigate the risk of CVE-2026-72763, it is critical to implement the following:
Patches:
The most effective solution is to upgrade your n8n instance to a patched version. The issue has been fixed in:
- n8n 1.123.67 or later
- n8n 2.31.5 or later
- n8n 2.32.1 or later
It is highly recommended to upgrade to one of these versions or a newer release as soon as possible.
Temporary Mitigations (if immediate upgrade is not possible):
If you cannot upgrade immediately, consider these temporary steps to reduce exposure:
- Restrict Workflow Sharing: Limit workflow sharing to only fully trusted users. Avoid granting “Editor” access to any untrusted individuals on workflows that utilize sensitive credentials.
- Audit Workflows: Regularly inspect shared workflows for “Execute Sub-workflow” nodes where the source is set to “Parameter.” Carefully review their inline workflow definitions for any unusual or unauthorized credential references.
- Control Network Egress: Restrict outgoing network connections from your n8n instance to prevent it from connecting to unknown or attacker-controlled servers.
Remember, these workarounds are not full fixes and should only be used as a temporary measure until you can apply the official patches.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-cj9h-qx8g-pq2g
https://www.vulncheck.com/advisories/n8n-before-credential-exfiltration-via-sub-workflow
