Authorization Bypass Vulnerability in n8n Workflow Automation Tool

CVE-2026-118642

What is CVE-2026-118642?

The n8n workflow automation tool prior to versions 1.123.85, 2.43.5, and 2.44.1 is vulnerable to an authorization bypass flaw. This vulnerability allows authenticated users to exploit inline sub-workflow nodes with non-boolean disabled values, thereby bypassing permission checks. An attacker who knows a credential ID can execute workflow nodes in inline JSON mode, sending decrypted credentials to external, attacker-controlled servers. This exposes sensitive information and can lead to further exploitation within the system.

References