Incorrect authorization in n8n - CVE-2026-110844
Published: September 30, 2026 / Updated: October 16, 2026
Vulnerability identifier: #VU153003
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-110844
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to perform actions using credential values they are not authorized to use.
The vulnerability exists due to improper authorization validation in the shared-workflow credential check when saving a shared workflow containing nested inline workflows. A remote user can save a workflow with embedded nodes that reference inaccessible credentials to perform actions using credential values they are not authorized to use.
Inline workflows can be nested.
Affected software
n8n
How to mitigate CVE-2026-110844
Install security update from vendor's website.
n8n - update to 1.123.83