CVE-2026-110853 n8n-io CVE debrief

Who should care

Defenders responsible for n8n deployments, particularly those with sensitive workflows or credentials, should assess exposure and prioritize verification and remediation. This includes operators managing n8n instances, platform administrators, vulnerability management teams, and security teams monitoring for potential unauthorized access or suspicious activity.

Why it matters

CVE-2026-110853 is a high-severity authorization bypass vulnerability in n8n before version 1.123.83. Defenders should prioritize verifying n8n versions, restricting access to sensitive workflows, and monitoring for suspicious activity.

• Potential unauthorized access to sensitive workflows and credentials
• Possible modification of workflow static data and error-workflow dispatch
• Need for verification of n8n versions and access controls
• Potential for lateral movement within n8n deployments

Technical summary

The vulnerability in n8n before version 1.123.83 allows authenticated members to spoof workflow identity by supplying a trusted identifier in Execute Sub-workflow inline JSON mode. This could potentially allow them to resolve credentials from projects they do not belong to and modify another workflow's static data and error-workflow dispatch. The issue is a high-severity authorization bypass vulnerability that defenders should prioritize verifying and remediating, especially in sensitive workflows or credentials environments.

Defensive priority

Defenders should prioritize verifying n8n versions and restricting access to sensitive workflows.

Recommended defensive actions

• Verify n8n version and upgrade to 1.123.83 or later
• Restrict access to sensitive workflows and credentials
• Monitor for suspicious activity in n8n workflows
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability in n8n before version 1.123.83, but additional verification is needed to confirm affected versions, potential impact, and specific workflows that may be exposed. Defenders should verify n8n versions, assess exposure of sensitive workflows, and monitor for suspicious activity. Evidence from the CVE Program and other sources indicates a high-severity authorization bypass vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.