Skip to content
CVE Ledger
  • Newest CVEsPage
  • Recently added to KEVPage
  • Rising exploitation (EPSS)Page
  • Weekly digestPage
  • StatisticsPage
  • WatchlistPage
  • API docsPage
  • MCP serverPage
  • AboutPage
  • Data sourcesPage
  • Data statusPage
  • ChangelogPage
  • How it's builtPage
  • Support the projectPage

14 results

Back

CVE-2026-72763n8n before 1.123.67 Credential Exfiltration via Sub-Workflow

Description

n8n before 1.123.67, 2.31.5, and 2.32.1 validates credential-access only for a node's top-level credentials and not for credentials referenced inside an Execute Sub-workflow node's inline workflow JSON. A member with Editor access to a shared workflow (when workflow sharing is enabled) who knows a target credential's ID can reference that credential in the inline JSON; it passes save-time and runtime validation and resolves in the parent workflow's project context, allowing the attacker to use or exfiltrate credentials they are not permitted to access.

Timeline

  1. ID reserved

    By VulnCheck

  2. · 1 day later

    Published

  3. · 3 months later

    Record updated

Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.

Scores

CVSS scores of CVE-2026-72763, by who scored it
Scored byCVSSScoreVector
VulnCheckCNA (assigner)4.0High7.2CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L
NVDNVD · Analyzed4.0High7.2CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS (exploitation in 30 days)
0.36% · top 70% of all CVEs (15 Nov 2026)
CISA SSVC
Exploitation: none · Automatable: no · Technical impact: total
Loading the EPSS history…

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.2.

Affected products

  • n8n-io · n8n

    • affected < 1.123.67
    • unaffected 1.123.67

  • n8n-io · n8n

    • affected 2.32.0 – < 2.32.1
    • unaffected 2.32.1

  • n8n-io · n8n

    • affected 2.0.0-rc.0 – < 2.31.5
    • unaffected 2.31.5

References

References2

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

CVE-2026-72763 badge
[![CVE-2026-72763](https://cveledger.app/badge/CVE-2026-72763.svg)](https://cveledger.app/cve/CVE-2026-72763)

Record last updated .