CVE-2026-86996 Overview
CVE-2026-86996 is a missing authorization vulnerability [CWE-862] in n8n, an open source workflow automation platform. Versions prior to 2.37.7 and 2.38.2 fail to enforce the This workflow can be called by setting when a workflow is attached to an Agent as a tool. The Execute Workflow node honors this restriction, but the Agent tool pathway bypasses it. A user permitted to build an Agent can invoke a restricted workflow and read the data it returns. The flaw resides in packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omits the SubworkflowPolicyChecker.checkForProject call. Maintainers addressed the issue in versions 2.37.7 and 2.38.2.
Critical Impact
Authenticated users with Agent-build permissions can invoke workflows outside their allowed scope and read the returned execution data, breaking multi-tenant workflow isolation.
Affected Products
- n8n versions prior to 2.37.7
- n8n versions prior to 2.38.2
- Deployments exposing Agent tools that call subworkflows
Discovery Timeline
- 2026-09-08 - CVE-2026-86996 published to NVD
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86996
Vulnerability Analysis
n8n enforces subworkflow access using the SubworkflowPolicyChecker service. When a workflow is called through the Execute Workflow node, the checker validates that the caller's project is permitted by the target workflow's This workflow can be called by setting. The Agent tool factory constructs a similar execution path but instantiates the workflow through executeWorkflow without invoking SubworkflowPolicyChecker.checkForProject. Any workflow reachable by the n8n instance can therefore be attached as a tool to an Agent and invoked at runtime.
The practical impact is a broken access control boundary between projects. Data that a user could not access through direct execution becomes retrievable through Agent-driven invocation. Because the Agent returns tool output back into the language model context, restricted workflow results can also leak into LLM prompts and downstream logs.
Root Cause
The defect is a missing authorization check in packages/cli/src/modules/agents/tools/workflow-tool-factory.ts. The Agent tool code path calls the internal executeWorkflow routine directly and does not delegate to SubworkflowPolicyChecker.checkForProject. The policy enforcement exists in the platform but is not applied at every subworkflow entry point.
Attack Vector
Exploitation requires an authenticated account with permission to create or edit an Agent workflow. The attacker adds a restricted workflow as an Agent tool, triggers the Agent, and observes the tool output. No user interaction from a victim is required, and the attack is executed over the network against the n8n API. See the GitHub Security Advisory GHSA-7hgx-277f-7vmg for maintainer details.
Detection Methods for CVE-2026-86996
Indicators of Compromise
- Agent workflow executions that reference target workflows outside the caller's project scope
- Unexpected workflow-tool-factory invocations in audit logs targeting sensitive subworkflows
- Agent tool outputs containing data structures from restricted workflows
Detection Strategies
- Review n8n execution history for Agent runs whose attached tools resolve to workflows the initiating user cannot execute directly
- Correlate workflow ownership metadata with Agent tool selections to surface cross-project invocations
- Alert on modifications to Agent workflows that add tools referencing workflows in other projects
Monitoring Recommendations
- Ingest n8n audit and execution logs into a centralized analytics platform for cross-project correlation
- Baseline normal Agent tool usage per project and flag deviations
- Monitor upgrades and version metadata to confirm all n8n instances run 2.37.7, 2.38.2, or later
How to Mitigate CVE-2026-86996
Immediate Actions Required
- Upgrade n8n to version 2.37.7 or 2.38.2 as published in the n8n@2.37.7 release and n8n@2.38.2 release
- Audit existing Agent workflows for tools that reference workflows in other projects
- Restrict Agent creation and editing permissions to trusted users until patched
Patch Information
n8n maintainers fixed the missing authorization check in versions 2.37.7 and 2.38.2 by ensuring the Agent tool factory invokes SubworkflowPolicyChecker.checkForProject before calling executeWorkflow. Patch details are documented in the GitHub Security Advisory GHSA-7hgx-277f-7vmg.
Workarounds
- Temporarily disable Agent nodes in environments that cannot be upgraded immediately
- Set every sensitive workflow's This workflow can be called by setting to the narrowest possible scope and validate downstream Agent usage manually
- Revoke Agent build permissions from accounts that do not require them, reducing the exploit population
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
