CVE-2026-86996 PUBLISHED

n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy

Assigner: GitHub_M
Reserved: 08.09.2026 Published: 08.09.2026 Updated: 08.09.2026

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted workflow and read its returned data. The affected path is packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omitted SubworkflowPolicyChecker.checkForProject. This issue is fixed in versions 2.37.7 and 2.38.2.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CVSS Score: 5.3

Product Status

Vendor n8n-io
Product n8n
Versions
  • Version < 2.37.7 is affected
  • Version >= 2.38.0, < 2.38.2 is affected

References

Problem Types

  • CWE-862: Missing Authorization CWE