What happened
Published Sept 3, 2026 (NVD, sourced from VulnCheck), this flaw specifically affects the Workflow Tool node — the mechanism n8n's AI Agent nodes use to invoke sub-workflows as callable tools — allowing credential exfiltration across privilege/ownership boundaries via MCP or API-driven workflow creation.
Why it matters
n8n's AI Agent + Workflow Tool pattern is a common way to build agentic tool-calling pipelines; this flaw lets a lower-privileged user or an MCP-driven automated process silently steal credentials owned by other users simply by crafting a workflow reference, without ever needing direct access to the credential store.
Attack vector
n8n does not validate credential references embedded in the inline workflow JSON of nodes that execute inline sub-workflows (e.g., the Workflow Tool node used by AI Agent nodes). A shared-workflow editor — or any user/agent creating or updating a workflow via REST API, Public API, or MCP — can persist a node referencing a credential they do not own. When later executed under the identity that holds that credential, the inline sub-workflow resolves the secret and can exfiltrate it to an attacker-controlled endpoint.
Affected systems
n8n before 2.35.4 and 2.36.x before 2.36.2
Mitigation
Upgrade to n8n 2.35.4 / 2.36.2 or later. See GHSA-4r56-g65c-fm83.