Listen to this Post
n8n is an open-source workflow automation platform that enables users to create complex automated processes by connecting various nodes. A key security feature in its architecture is the ability to restrict certain workflows so they can only be invoked under specific conditions, such as being called directly via a dedicated Execute Workflow node rather than through other integration points like agents or external APIs. This restriction mechanism relies on a policy checker that validates whether the current execution context permits access to the target workflow based on project-level permissions and security policies.
The technical flaw stems from an inconsistency in how this authorization check is applied across different invocation paths within the codebase. Specifically, when a workflow was attached to an Agent as a tool, the system failed to enforce the same restrictions that were strictly enforced during direct execution via the Execute Workflow node. The root cause lies in the file packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where the `executeWorkflow` function omitted a call to SubworkflowPolicyChecker.checkForProject. This omission meant that while standard workflow executions underwent rigorous policy validation, agent-invoked workflows bypassed this security gate entirely.
Consequently, any user with the ability to build or configure an Agent could leverage this path to invoke workflows marked as restricted, effectively circumventing the intended access controls designed by administrators and developers. The operational impact is significant for organizations relying on n8n for sensitive automation tasks involving proprietary data or critical business logic. An attacker who can create agents within the platform gains the ability to read returned data from workflows that were explicitly configured to be inaccessible via agent tools. This could lead to unauthorized disclosure of confidential information, such as customer data, financial records, or internal system states. Since n8n is often used in enterprise environments where role-based access control is crucial for compliance with standards like GDPR or HIPAA, this bypass undermines the integrity of those security models.
DailyCVE Form:
Platform: n8n
Version: <2.37.7, 2.38.0–2.38.1
Vulnerability: Authorization Bypass
Severity: Medium (CVSS 5.3)
Date: 2026-09-08
Prediction: Patch already available (2.37.7/2.38.2)
What Undercode Say:
The vulnerability exists in the Agent tool execution path where the sub-workflow caller policy is not enforced. The following command can be used to check the current n8n version:
n8n --version
To verify if the instance is vulnerable, inspect the workflow-tool-factory.ts file:
grep -n "SubworkflowPolicyChecker" packages/cli/src/modules/agents/tools/workflow-tool-factory.ts
If the check is missing, the instance is vulnerable. The fixed implementation should include:
// Fixed code should include: await SubworkflowPolicyChecker.checkForProject( this.workflowRepository, this.projectRepository, workflowId, projectId );
Exploit: (Educational Purposes!)
An attacker with Agent creation privileges can exploit this by:
1. Creating a new Agent within the n8n platform
2. Attaching a restricted workflow as a tool to the Agent
3. Executing the Agent, which triggers the workflow without policy enforcement
4. Reading the returned data from the restricted workflow
The attack vector is network-based, requires low privileges, and needs no user interaction.
Protection:
- Upgrade to n8n version 2.37.7 or 2.38.2 immediately
- If upgrading is not immediately possible:
- Restrict n8n instance access to fully trusted users only
- Audit workflows attached as Agent tools and review their caller policy settings
- Remove sensitive workflows from Agent tool configurations until the instance is patched
Impact:
Unauthorized disclosure of confidential information from restricted workflows, including customer data, financial records, and internal system states. The vulnerability undermines role-based access control models and can lead to non-compliance with regulations such as GDPR or HIPAA.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
