A significant security flaw has been identified in n8n, an open-source workflow automation platform. This vulnerability, tracked as CVE-2026-85166, could allow unauthorized individuals to gain access to sensitive credentials, posing a serious risk to data security. The issue lies in how n8n handles credential references within its inline workflow JSON, specifically in nodes designed to execute sub-workflows, such as the Workflow Tool node.<\/p>\n
Under certain conditions, an attacker could craft a malicious workflow that appears harmless but secretly references credentials they don’t own. If this workflow is then executed by a user who does possess those credentials, the attacker’s sub-workflow could resolve the hidden secrets and transmit them to an endpoint controlled by the attacker. While the attacker never directly possesses the credentials within n8n, this method enables their exfiltration.<\/p>\n
Product:<\/strong> n8n<\/p>\n Published Date:<\/strong> September 3, 2026<\/p>\n Severity:<\/strong> High<\/p>\n Status:<\/strong> Analyzed<\/p>\n The vulnerability impacts n8n versions before 2.35.4<\/strong> and 2.36.x before 2.36.2<\/strong>. Users running any n8n instance within these version ranges are advised to take immediate action.<\/p>\n The vulnerability has been officially “Analyzed” and publicly disclosed. This means the details are known, and solutions have been developed by the vendor.<\/p>\n This vulnerability is rated as High<\/strong> severity. This rating reflects the potential for serious consequences if exploited, primarily due to the risk of sensitive credential exfiltration. While the attacker doesn’t directly gain control of the n8n system, the ability to steal credentials can lead to unauthorized access to other linked systems and services, causing significant damage and compromise.<\/p>\n The good news is that n8n has already released patches to address this issue. To protect your n8n instances, you should:<\/p>\n If an immediate upgrade is not feasible, consider these temporary mitigation steps:<\/p>\n Please remember that these workarounds are not a full fix and should only be considered as short-term measures until a proper upgrade can be performed.<\/p>\n https:\/\/github.com\/n8n-io\/n8n\/security\/advisories\/GHSA-4r56-g65c-fm83 Understanding the n8n Credential Exfiltration Vulnerability (CVE-2026-85166) A significant security flaw has been identified in n8n, an open-source workflow automation platform. This vulnerability, tracked as CVE-2026-85166, could allow unauthorized individuals to gain access to sensitive credentials, posing a serious risk to data security. The issue lies in how n8n handles credential references within its inline […]<\/p>\n","protected":false},"author":17,"featured_media":3515,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1089,804,1067,702,1068],"class_list":["post-3968","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-credential-exfiltration","tag-data-security","tag-n8n","tag-security-advisory","tag-workflow-automation"],"blocksy_meta":[],"yoast_head":"\nAffected Products<\/h2>\n
Current Status<\/h2>\n
Severity Level<\/h2>\n
Possible Solutions<\/h2>\n
\n
\n
References<\/h2>\n
\nhttps:\/\/www.vulncheck.com\/advisories\/n8n-before-2.36.2-credential-exfiltration-via-workflow-tool-node<\/p>\n","protected":false},"excerpt":{"rendered":"