CVE-2026-86996: 
MinimOS vulnerability analysis and mitigation

CVE-2026-86996 is a missing authorization vulnerability in n8n, an open-source workflow automation platform, titled "Agent Workflow Tool Bypasses Sub-Workflow Caller Policy." The flaw affects all n8n versions prior to 2.37.7 and versions 2.38.0 through 2.38.2 (exclusive). It was published on September 2, 2026, and added to the GitHub Advisory Database on September 8, 2026. The vulnerability carries a CVSS v4.0 base score of 5.3 (Medium) (Github Advisory, n8n Security Advisory).

The root cause is a missing authorization check (CWE-862) in the Agent tool execution path. Specifically, the file packages/cli/src/modules/agents/tools/workflow-tool-factory.ts invoked executeWorkflow without calling SubworkflowPolicyChecker.checkForProject, meaning the "This workflow can be called by" access control setting was enforced when using the Execute Workflow node but was entirely bypassed when a workflow was attached to an Agent as a tool. An authenticated user with sufficient privileges to build an Agent could exploit this by attaching a restricted sub-workflow as an Agent tool and triggering its execution, thereby reading the returned data without authorization. No special attack requirements or user interaction beyond low-privilege access are needed (Github Advisory, n8n Security Advisory).

Successful exploitation allows an authenticated attacker to invoke workflows they are not authorized to call and read the data those workflows return, resulting in unauthorized information disclosure. The integrity of the access control model is also undermined, as an attacker could potentially trigger restricted workflow logic and observe or influence downstream system behavior. Availability is not directly impacted. The scope of exposure depends on the sensitivity of data processed by restricted workflows within the affected n8n instance (Github Advisory).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the advisory date. The EPSS score is 0.0, indicating a very low probability of near-term exploitation, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires a low-privilege authenticated account on the n8n instance, limiting the attack surface to internal or semi-trusted users (Github Advisory).

1. Gain access: Obtain a low-privilege authenticated account on a vulnerable n8n instance (version < 2.37.7 or 2.38.0–2.38.1).
2. Identify restricted workflows: Browse or enumerate available workflows within the n8n instance to identify workflows whose "This workflow can be called by" setting restricts external callers.
3. Create an Agent: In the n8n UI, create a new Agent workflow that supports tool use.
4. Attach restricted workflow as a tool: Configure the Agent to use the target restricted workflow as a tool, bypassing the caller policy check that would normally block this invocation path.
5. Trigger the Agent: Execute the Agent, causing it to invoke the restricted sub-workflow via the vulnerable workflow-tool-factory.ts code path, which omits the SubworkflowPolicyChecker.checkForProject call.
6. Read returned data: Observe the Agent's output, which includes the data returned by the restricted workflow, achieving unauthorized information disclosure (n8n Security Advisory).

• Logs: n8n execution logs showing Agent-type workflow executions that invoke sub-workflows owned by other users or projects, particularly workflows with restricted caller policies; unexpected workflow execution records for workflows not normally accessible to the executing user.
• Application Behavior: Agent workflows referencing sub-workflows that are not listed as permitted callers in those sub-workflows' settings; audit logs (if enabled) showing cross-project or cross-user workflow invocations via the Agent tool path.

n8n has released patched versions 2.37.7 and 2.38.2, which apply the SubworkflowPolicyChecker.checkForProject check to the Agent tool execution path. Users should upgrade to one of these versions or later as the primary remediation (n8n Release 2.37.7, n8n Release 2.38.2). If immediate upgrade is not possible, administrators should: restrict n8n instance access to fully trusted users only; audit workflows attached as Agent tools and review their caller policy settings; and remove sensitive workflows from Agent tool configurations until the instance is patched. These workarounds do not fully remediate the risk (n8n Security Advisory).

The vulnerability was reported by researcher vonypeto and published by n8n maintainer csuermann via GitHub's security advisory process. No significant broader media coverage, researcher commentary, or notable social media discussion has been identified beyond the standard advisory publication (Github Advisory).