Summary
An authorization bypass in n8n may allow authenticated members to use credentials they are not authorized to access through inline sub-workflow nodes. An attacker who knows a credential identifier could trigger an Execute Workflow node in inline JSON mode and cause decrypted credentials to be sent to an attacker-controlled server.
An authorization bypass in n8n may allow authenticated members to use credentials they are not authorized to access through inline sub-workflow nodes. An attacker who knows a credential identifier could trigger an Execute Workflow node in inline JSON mode and cause decrypted credentials to be sent to an attacker-controlled server.
Affected context
The issue may occur in n8n deployments where authenticated members can create or execute workflows using inline sub-workflow definitions. Risk increases when Execute Workflow nodes accept non-boolean values for the disabled property, allowing permission checks to be bypassed, and when an attacker can determine or obtain a valid credential identifier.
The issue may occur in n8n deployments where authenticated members can create or execute workflows using inline sub-workflow definitions. Risk increases when Execute Workflow nodes accept non-boolean values for the disabled property, allowing permission checks to be bypassed, and when an attacker can determine or obtain a valid credential identifier.
Exploit preconditions
- Attack surface: Workflow creation or execution through n8n's Execute Workflow functionality
- Required access: An authenticated account with member-level workflow capabilities
- Required knowledge: A valid identifier for a credential that the account should not be able to use
- Trigger point: Execution of an inline JSON sub-workflow containing an Execute Workflow node
- Why exploitation is possible: A non-boolean disabled value can cause authorization logic to skip the intended credential permission check
- Attack surface: Workflow creation or execution through n8n's Execute Workflow functionality
- Required access: An authenticated account with member-level workflow capabilities
- Required knowledge: A valid identifier for a credential that the account should not be able to use
- Trigger point: Execution of an inline JSON sub-workflow containing an Execute Workflow node
- Why exploitation is possible: A non-boolean disabled value can cause authorization logic to skip the intended credential permission check
Why this happens
The underlying flaw is an authorization enforcement error in which a value with an unexpected type is interpreted in a way that bypasses a security decision. When the inline sub-workflow is processed, the malformed disabled property can prevent the credential access check from being applied consistently. This maps to CWE-863: Incorrect Authorization, because an authenticated user may access a protected credential without the required authorization.
The underlying flaw is an authorization enforcement error in which a value with an unexpected type is interpreted in a way that bypasses a security decision. When the inline sub-workflow is processed, the malformed disabled property can prevent the credential access check from being applied consistently. This maps to CWE-863: Incorrect Authorization, because an authenticated user may access a protected credential without the required authorization.
Potential impact
- Attackers may use credentials assigned to other users or workflows
- Decrypted credential material could be transmitted to attacker-controlled systems
- Connected services may be accessed or modified without proper authorization
- Sensitive data, tokens, or secrets could be exposed
- Downstream systems could be affected through unauthorized workflow actions
- Attackers may use credentials assigned to other users or workflows
- Decrypted credential material could be transmitted to attacker-controlled systems
- Connected services may be accessed or modified without proper authorization
- Sensitive data, tokens, or secrets could be exposed
- Downstream systems could be affected through unauthorized workflow actions
General mitigation guidance
Mitigation should focus on enforcing authorization independently of user-controlled workflow values and treating type confusion as a security boundary failure.
Common defensive patterns include:
- Validate security-sensitive properties against strict types and allowed values
- Perform credential authorization checks after parsing and normalization, immediately before use
- Deny access by default when a property is missing, malformed, or unexpected
- Avoid exposing decrypted credentials to workflow data or external destinations
- Limit member permissions for workflow creation, editing, and execution
- Restrict outbound network access from workflow runners where practical
- Rotate credentials that may have been exposed and review their use for suspicious activity
Mitigation should focus on enforcing authorization independently of user-controlled workflow values and treating type confusion as a security boundary failure.
Common defensive patterns include:
- Validate security-sensitive properties against strict types and allowed values
- Perform credential authorization checks after parsing and normalization, immediately before use
- Deny access by default when a property is missing, malformed, or unexpected
- Avoid exposing decrypted credentials to workflow data or external destinations
- Limit member permissions for workflow creation, editing, and execution
- Restrict outbound network access from workflow runners where practical
- Rotate credentials that may have been exposed and review their use for suspicious activity
How teams detect issues like this
Detection approaches may include:
- Static analysis for authorization decisions controlled by loosely typed or user-supplied values
- Code review checks verifying that credential permissions are enforced at the final access point
- Tests covering non-boolean, missing, null, and unexpected values for security-sensitive fields
- Runtime monitoring for members accessing credentials outside their assigned scope
- Audit logging of credential resolution, workflow execution, and outbound data transfers
- Policy enforcement that restricts inline sub-workflow execution and external destinations
- Automated security review tools configured to identify CWE-863 authorization weaknesses
Detection approaches may include:
- Static analysis for authorization decisions controlled by loosely typed or user-supplied values
- Code review checks verifying that credential permissions are enforced at the final access point
- Tests covering non-boolean, missing, null, and unexpected values for security-sensitive fields
- Runtime monitoring for members accessing credentials outside their assigned scope
- Audit logging of credential resolution, workflow execution, and outbound data transfers
- Policy enforcement that restricts inline sub-workflow execution and external destinations
- Automated security review tools configured to identify CWE-863 authorization weaknesses
