CVE-2026-86996: CWE-862: Missing Authorization in n8n-io n8n
Affects n8n-io n8nSource CVE Database V5
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 20% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:NWhat to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| n8n-ion8n | Affected
| Fixed in– |
npmn8n-io/n8npkg:npm/n8n-io/n8nOther threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Upgrade n8n to version 2.37.7 or 2.38.2 or later, where this authorization bypass vulnerability has been fixed. No other mitigation or temporary workaround is indicated by the vendor advisory.
Description
n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted workflow and read its returned data. The affected path is packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omitted SubworkflowPolicyChecker.checkForProject. This issue is fixed in versions 2.37.7 and 2.38.2.
Impact
An attacker with the ability to build an Agent in n8n could bypass intended workflow call restrictions and invoke restricted workflows, potentially accessing sensitive data returned by those workflows. This could lead to unauthorized data disclosure within the affected n8n environment.
Summary
The vulnerability in n8n (CVE-2026-86996) involves a missing authorization enforcement in the workflow execution path when workflows are attached to Agents as tools. Specifically, the workflow setting 'This workflow can be called by' was enforced by the Execute Workflow node but omitted in the Agent tool execution path, located in packages/cli/src/modules/agents/tools/workflow-tool-factory.ts. The omission of SubworkflowPolicyChecker.checkForProject allowed users with Agent build permissions to invoke restricted workflows and read their returned data. This authorization bypass was addressed and fixed in n8n versions 2.37.7 and 2.38.2.