Agents
n8n CVE-2026-86996: attaching a workflow to an Agent as a tool bypassed its own caller policy
n8n's "This workflow can be called by" restriction was enforced by the Execute Workflow node but never consulted when the same workflow was attached to an Agent as a tool, so any user who could build an Agent could invoke a workflow its owner had restricted and read back the result. Disclosed 2026-09-08 as GHSA-7hgx-277f-7vmg (medium), patched in n8n 2.37.7 and 2.38.2, with vulnerable ranges <2.37.7 and >=2.38.0,<2.38.2. This is the recurring shape in agent workflow platforms: an authorization check written for the human-facing execution path is simply absent on the agent tool path.
↳ Follow the thread