n8n EUVD-2026-112381

Exploitation requires an authenticated user holding EDITOR rights on a SHARED workflow (consistent with PR:L), and the ability to serve sub-workflow content the n8n process can fetch - either a reachable URL or a local file. The specific trigger is configuring the Execute Sub-workflow node with source 'url' or 'localFile' so that content loaded at run time (which the save-time credential guard never inspects) resolves the project's credentials. Limiting factors: the attacker must already have shared-workflow editor access (not anonymous/remote-unauthenticated), the n8n process must be able to reach the attacker-served URL or file, and fully-trusted-only editor populations eliminate the practical threat. Vendor mitigations: restrict instance access and editor rights to fully trusted users, audit/remove Execute Sub-workflow nodes using source url/localFile, and apply network controls preventing the n8n process from reaching attacker-controlled infrastructure - these are partial and do not fully remediate; upgrading to 1.123.85, 2.43.5, or 2.44.1 (or later) is the complete fix.

This is a moderate-severity, insider-oriented authorization flaw rather than a mass-exploitation emergency. The vendor CVSS 4.0 vector scores 5.1 (medium) with AV:N/AC:L/AT:P/PR:L/UI:N: network-reachable but requiring low-level authenticated privilege (PR:L, an editor of a shared workflow) plus an attack requirement (AT:P, the attacker must be able to serve sub-workflow content and operate within the shared-workflow editing flow). The defining signal is SC:H - a subsequent-system confidentiality impact: decrypted project credentials the editor was never authorized to use are returned to them, a genuine scope/trust-boundary break (CWE-863, improper authorization). Exploitation signals are weak-to-absent: no CISA KEV entry, no EPSS probability supplied in the input, and no public exploit identified at time of analysis (the two references are the GHSA and VulnCheck advisories, not PoC code). The vuln.today decision label is 'this_month', consistent with these signals - not act_now or emergency. Net: real priority for organizations that grant workflow-editing access to partially-trusted users (the threat model is a malicious or compromised editor escalating to steal credentials), but low urgency where n8n editors are all fully trusted. No key signals are internally contradictory; EPSS is simply not provided, so widespread-automated-exploitation likelihood cannot be quantified from the input.

A user with editor rights to a shared workflow adds an Execute Sub-workflow node configured with source 'url' or 'localFile' pointing to content they control. Because n8n's save-time credential guard never inspects externally-loaded sub-workflow content, the served sub-workflow resolves the project's restricted credentials and returns their decrypted values to the editor. No public exploit code was identified at time of analysis; exploitation requires only authenticated editor access and the ability to host a file or URL the n8n process can reach.