Credential Permission Check Skips Inline Sub-Workflow Nodes With a Non-Boolean Disabled Value
概要
Impact
Before a workflow runs, n8n checks that the user may use each credential its nodes reference. The check and the execution engine decided in different ways whether a node is disabled, so a node inside an inline sub-workflow could be skipped by the check and still run. A member who knows th...
影響パッケージ
| 種類 | パッケージ | 影響を受ける版 | 直った版 |
|---|---|---|---|
| npm | n8n |
< 1.123.85 |
>= 1.123.85 |
| npm | n8n |
< 2.44.1 |
>= 2.44.1 |
| npm | n8n |
< 2.43.5 |
>= 2.43.5 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
Impact
Before a workflow runs, n8n checks that the user may use each credential its nodes reference. The check and the execution engine decided in different ways whether a node is disabled, so a node inside an inline sub-workflow could be skipped by the check and still run. A member who knows the id of a credential they have no access to can run such a node and send the decrypted credential to a server they control.
Patches
The issue has been fixed in n8n versions 1.123.85, 2.43.5, and 2.44.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
- Restrict n8n instance access to fully trusted users only.
- Audit execution logs for unexpected successful executions of Execute Workflow nodes using inline JSON mode.
- Remove member access from any users who are not fully trusted until the instance is patched.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
出典: GitHub Repository Security Advisories (Game のスタック) GitHub Advisory OSV
参照URL
- GITHUB_REPO_ADVISORY n8n-io/n8n