CVE-2026-85166: n8n before 2.36.2 Credential Exfiltration via Workflow Tool Node

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-03 · updated 2026-10-29
Weakness: CWE-863

Description

n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow (e.g., the Workflow Tool node). A shared-workflow editor, or any user creating/updating a workflow via the REST API, Public API, or MCP, can persist a node referencing a credential they do not own. When the workflow is later executed under an identity that holds the credential, the inline sub-workflow resolves the secret and can send it to an attacker-controlled endpoint, resulting in credential exfiltration.

Affected products

n8n-io n8n: before 2.35.4; from 2.36.0 before 2.36.2 — fixed in 2.35.4, 2.36.2
n8n-io n8n: from 2.36.0 before 2.36.2 — fixed in 2.36.2

How to fix

Upgrade to a fixed version: n8n-io n8n 2.35.4, 2.36.2; n8n-io n8n 2.36.2. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-85166 or the next vulnerability affects your stack