CVE-2026-86996 n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy

Medium 5.3 Published 8 Sep 2026 Updated 9 Sep 2026

An attacker can bypass sub-workflow caller restrictions in n8n Agents to invoke restricted workflows and read their returned data.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-86996?

CVE-2026-86996 is a medium-severity missing authorization vulnerability in N8n N8n, published on 8 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the Execute Workflow node but not when a workflow was attached to an Agent as a tool. A user able to build an Agent could invoke a restricted workflow and read its returned data. The affected path is packages/cli/src/modules/agents/tools/workflow-tool-factory.ts, where executeWorkflow omitted SubworkflowPolicyChecker.checkForProject. This issue is fixed in versions 2.37.7 and 2.38.2.

Weakness: CWE-862

Which versions are affected by CVE-2026-86996?

4 open source packages ship an affected version, including n8n. It affects 1 product.

Package	Affected	Fixed in
`n8n` npm	All versions	`2.37.7`
`n8n` npm	All versions	`2.37.7`
`n8n` npm	From `2.38.0`	`2.38.2`
`n8n` npm	From `2.38.0`	`2.38.2`

Products include N8n N8n.

How do I fix CVE-2026-86996?

Upgrade n8n to a fixed version for your release line: 2.37.7 or 2.38.2.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2026-86996 being exploited?

There is no known exploitation of CVE-2026-86996 in the wild and no public exploit code.

All N8n N8n vulnerabilities

Sources

Also known as GHSA-7hgx-277f-7vmg, MINI-hrrj-r5vw-67qp.