CVE-2026-85166
Description
n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node). A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can persist a node referencing a credential they do not own. When the workflow is later executed under an identity that holds the credential, the inline sub-workflow resolves the secret and can send it to an attacker-controlled endpoint, resulting in credential exfiltration.
How to fix
- n8n n8n2.35.4, 2.36.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| n8n n8n | v < 2.35.4, 2.36.0 ≤ v < 2.36.2 | 2.35.4, 2.36.2 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.