Vibe Coding
CVE-2026-85166: n8n lets a workflow reference a credential its author does not own, and MCP is one of the doors
n8n before 2.35.4 and 2.36.x before 2.36.2 does not validate credential references in the inline workflow JSON of nodes that run an inline sub-workflow, such as the Workflow Tool node. A shared-workflow editor, or anyone creating or updating a workflow through the REST API, the Public API or MCP, can persist a node pointing at a credential belonging to someone else, which then resolves when the workflow later executes under an authorized identity. The MCP path matters here because it means an agent with n8n workflow-write access is a credential-escalation vector, not just an automation client.
Source
↳ Follow the thread