CVE-2026-86996: n8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy

September 8, 2026

A workflow’s “This workflow can be called by” setting was enforced by the Execute Workflow node but was not consulted when the same workflow was attached to an Agent as a tool. A user who could build an Agent could therefore call a workflow that its owner had restricted, and read back what it returned. The patch applies the sub-workflow caller policy on the Agent tool path.

References

github.com/advisories/GHSA-7hgx-277f-7vmg
github.com/n8n-io/n8n/releases/tag/n8n@2.37.7
github.com/n8n-io/n8n/releases/tag/n8n@2.38.2
github.com/n8n-io/n8n/security/advisories/GHSA-7hgx-277f-7vmg
nvd.nist.gov/vuln/detail/CVE-2026-86996

Code Behaviors & Features

Detect and mitigate CVE-2026-86996 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →