Privilege Escalation in n8n Workflow Execution

Executive Summary

This vulnerability in n8n versions before 1.123.67, 2.31.5, and 2.32.1 allows credential exfiltration through the Shared-Workflow Editor. It occurs because credential-access checks only validate top-level credentials in a node, not those referenced inside an Execute Sub-workflow node's inline JSON. An attacker with Editor access to a shared workflow can embed a credential they shouldn't have access to within the inline workflow JSON, which then resolves in the parent workflow's context.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, audit shared workflows for Execute Sub-workflow nodes containing inline JSON with credential references. Check n8n versions for affected releases (before 1.123.67, 2.31.5, 2.32.1). Inspect workflow sharing settings and Editor access permissions.

Useful 0 Not Useful 0

Impact Analysis

An attacker could use or exfiltrate credentials they are not permitted to access, potentially leading to unauthorized data access, data breaches, or further exploitation of connected systems. This requires workflow sharing to be enabled, Editor access for the attacker, and knowledge of the target credential's ID.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements such as GDPR (data protection) and HIPAA (health information privacy). It may result in data breaches, unauthorized disclosures, and failure to meet regulatory standards for access controls and data protection.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade n8n to patched versions (1.123.67, 2.31.5, 2.32.1 or later). Restrict workflow sharing to trusted users only. Audit existing shared workflows for suspicious Execute Sub-workflow nodes. Implement network egress restrictions from the n8n instance to limit credential exfiltration.

Useful 0 Not Useful 0