CyberRota Analysis
AI-GeneratedThe vulnerability affects n8n versions prior to 1.123.67, 2.31.5, and 2.32.1, where insufficient validation of credentials allows users with Editor access to exploit inline workflows and access unauthorized credentials. This flaw enables attackers to potentially exfiltrate sensitive information, posing a significant risk to data security. Organizations utilizing n8n with shared workflows should prioritize patching to mitigate the risk of credential exposure.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow (when workflow sharing is enabled) who knows a target credential's ID can reference that credential in the inline JSON; it passes save-time and runtime validation and resolves in the parent workflow's project context, allowing the attacker to use or exfiltrate credentials they are not permitted to access.