CVE-2026-110844 n8n-io CVE debrief

Who should care

Defenders responsible for n8n deployments should assess exposure and prioritize verification and remediation. This includes reviewing workflows for potential credential bypass vulnerabilities, verifying the affected scope, severity, and vendor guidance, and monitoring workflow executions for suspicious activity. Additionally, defenders should check relevant monitoring, detection, and logs for exposed assets that need extra review and track exceptions, re

Why it matters

Defenders should prioritize verifying and upgrading to n8n version 1.123.83 or later, and review workflows for potential credential bypass vulnerabilities.

• Credential bypass may allow unauthorized access to sensitive data
• Workflow owners may be impacted by unauthorized credential usage
• Defenders should verify workflow configurations to prevent exploitation

Technical summary

The vulnerability allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. This enables attackers to save workflows with Workflow Tool or Workflow Retriever inline definitions referencing restricted credentials, which execute using the workflow owner's credential values. The affected product is n8n, a workflow automation tool. The vulnerability class is authorization bypass, which can lead to unauthorized access to sensitive data. The technical impact includes the potential for credential bypass and unauthorized access to sensitive data.

Defensive priority

Defenders should prioritize verifying and upgrading to n8n version 1.123.83 or later, and review workflows for potential credential bypass vulnerabilities.

Recommended defensive actions

• Verify and upgrade to n8n version 1.123.83 or later
• Review workflows for potential credential bypass vulnerabilities
• Monitor workflow executions for suspicious activity
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record and source item provide details on the authorization bypass vulnerability in n8n before 1.123.83. The vulnerability allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. The source item provides additional context on the vulnerability, including its impact on n8n deployments. Defenders should verify the affected scope, severity, and vendor guidance to assess exposure and prioritize verification and remediation. The evidence limits of the CVE record

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.