n8n Agent Tool Access Control Bypass of Sub-Workflow Caller Policy

Technical Analysis

The n8n platform enforces per-workflow caller policies (restricting which other workflows/users may invoke a given workflow) at the Execute Workflow node, but this enforcement was missing on the code path used when a workflow is registered as a callable tool for an AI Agent node. An attacker or low-trust user with permission to configure Agents could attach a restricted workflow as an agent tool, causing the agent's planner/LLM to invoke it via tool-calling and return its output, effectively circumventing the intended authorization boundary. This crosses the trust boundary between the workflow orchestration layer (which enforces access control) and the agentic tool-invocation layer (which did not), granting the attacker read access to sensitive workflow logic/output and indirectly to any credentials or data that workflow processes. The vulnerability is an authorization gap rather than a prompt-injection or model-manipulation issue, but it demonstrates how agent tool integrations can silently reintroduce privilege-escalation paths around otherwise well-enforced platform controls.

Affected Systems

n8n

Detection Signatures

• Audit logs showing Agent tool invocations of workflows with a non-default 'This workflow can be called by' restriction
• Workflow execution history where caller identity does not match the configured allowed callers list
• Agent tool configurations referencing workflows outside the builder's normal ownership/permission scope
• Discrepancy between Execute Workflow node enforcement logs and Agent tool node execution logs for the same workflow ID

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 2.37.7, 2.38.2, or later where the sub-workflow caller policy is enforced on the Agent tool invocation path.

2. 2

   Audit Agent tool configurations

   Review all workflows attached as AI Agent tools and verify their caller policy settings match intended access restrictions.

3. 3

   Restrict instance access

   Until patched, limit n8n instance and Agent-building capability to fully trusted users only.

4. 4

   Remove sensitive workflows from Agent tools

   Temporarily detach workflows containing sensitive logic, credentials, or data output from any Agent tool configuration.

5. 5

   Implement least-privilege for workflow builders

   Separate permissions for creating/editing Agents from permissions to reference or attach arbitrary existing workflows as tools.