CVE-2026-85166

n8n before 2.35.4 and 2.36.x before 2.36.2 fails to validate credential references in the inline workflow JSON of nodes that execute an inline sub-workflow, such as the Workflow Tool node (CWE-863, incorrect authorization). A user with workflow-editing rights — a shared-workflow editor, or anyone creating or updating a workflow via the REST API, Public API, or MCP — can persist a node that references a credential they do not own. When that workflow is later executed under an identity that holds the referenced credential, the inline sub-workflow resolves the secret and can send it to an attacker-controlled endpoint, exfiltrating credentials with high confidentiality impact. Any n8n deployment on affected versions where multiple users, shared workflows, or API/MCP-driven workflow creation is in use is affected; single-user instances face limited risk. Exploitation is not currently observed: there is no public PoC, CISA KEV listing is absent, and EPSS puts 30-day exploitation probability at about 0.2%.

What to do: Upgrade n8n to 2.35.4 or 2.36.2 (or later). Until patched, review existing workflows — especially Workflow Tool and other inline sub-workflow nodes — for credential references owned by other users or higher-privileged identities, and restrict workflow creation/updates via the REST API, Public API, and MCP to trusted users. After upgrading, audit recent workflow executions and outbound endpoints for signs that secrets were sent to unexpected destinations.