The Caller Policy Guarded One Door. The Agent Tool Was a Second Door.

Read the advisory's own single sentence describing the fix and it tells you almost everything about the shape of the bug without telling you a single line of code: the sub-workflow caller policy needed to be applied on the Agent tool path, meaning it had not been. Somewhere in n8n's own execution logic, a restricted workflow had two doors into the same room, and the lock was only ever fitted to one of them.

What the advisory itself states

GitHub Security Advisory GHSA-7hgx-277f-7vmg, titled "Agent Workflow Tool Bypasses Sub-Workflow Caller Policy," fetched directly by this session across two independent requests, formally assigns CVE-2026-86996, CVSS 4.0 base score 5.3, Moderate, vector CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N, with no CWE identifier listed. Its own description states the mechanism plainly: when a workflow owner configures the "This workflow can be called by" setting, restricting which other workflows may invoke theirs, n8n enforced that restriction through the Execute Workflow node's own request path. The identical workflow, attached as a tool to an AI Agent node instead, reached execution with no equivalent check, letting a user with Agent-building capability invoke a restricted workflow and retrieve its output regardless of whether that user was among the callers the policy actually named. The advisory names the affected range as n8n before 2.38.2 and before 2.37.7, the fixed versions as 2.38.2 and 2.37.7, credits reporter vonypeto, and states its own patch in one sentence: the fix "applies the sub-workflow caller policy on the Agent tool path."

A shipped fix, read against what its own changelog says

This record fetched n8n's own GitHub releases page directly. Version 2.37.7 is listed, published 2 September 2026. Its own visible changelog entry carries no bug-fix or feature description, only the version comparison link; the substantive changelog content immediately preceding it, for 2.37.6, describes an unrelated core fix threading an execution id through dynamic-credential storage. Version 2.38.2 did not appear among the releases this session's fetch returned. An empty changelog entry for a release the advisory itself names as a security fix is not unusual for a security-only release; n8n's own general practice of omitting sensitive fix detail from a public changelog is a reasonable, common vendor choice, and this record treats the absence as consistent with, not contradicting, the advisory's own account.

Why this matches AEW-028 rather than a new weakness

A companion record on this desk already documents the same architecture at a different vendor: Ruflo's own MCP bridge carried a correctly written blocklist, isBlockedTool, that worked everywhere it actually ran, called from exactly one place, the request handler for Ruflo's autopilot mode, while two direct MCP endpoints reached the same underlying executeTool function with no call to that check at all. That occurrence is the first known example on AEW-028, a capability's enforcement gate wired to one caller instead of the executor every caller shares. n8n's own advisory describes the identical shape at the level of its own prose: a caller policy, present and correctly enforced through one specific request path, the Execute Workflow node, and never invoked on a second, independently reachable path into the same underlying sub-workflow execution, an Agent node using that workflow as a tool. Both occurrences are a check that exists, is demonstrably not absent, and simply is never reached by a caller the system's own design later grew to support. This record connects n8n's own advisory to AEW-028 as a second known example rather than proposing a new weakness, since no part of AEW-028's own summary, description, authorityGap or response patterns needs to change to state what this advisory adds; the pattern the weakness already names in vendor-neutral terms already covers it.

Why this record holds a lower confidence than Ruflo's own occurrence, and does not open a new AEV

This record's own evidentiary position is deliberately weaker than the source-level confirmation Ruflo's own occurrence achieved, and states that difference rather than smoothing over it. This desk read Ruflo's own pre-fix and post-fix source directly, at named commits, and confirmed exactly where isBlockedTool was and was not called. For n8n's own advisory, this record has the advisory's own one-sentence patch description and nothing beneath it: no commit, no pull request, no diff. A targeted search of n8n's own pull requests for terms matching the advisory's own description, workflow caller policy and Agent tool, returned several pull requests from the same general period, deprecating an unrelated caller-policy option, enforcing policy at workflow publish time, and tracking workflow tools as background jobs, none of which state the specific fix GHSA-7hgx-277f-7vmg describes; this record does not adopt any of them as the fix, since none independently confirms it. Consistent with the bar this dataset already applies to AEW-020's own third known example, AWS Labs' postgres-mcp-server (GHSA-pwr4-hmph-gqgc, also a formally assigned CVE with a shipped fix and no located source diff), this record adds n8n's occurrence as a known example without opening a new AEV: an advisory-stated mechanism this session could not verify at the source level is held to the same, lower evidentiary bar that occurrence was held to, not treated as equivalent to a source-confirmed one merely because both carry a CVE.

What this record deliberately does not extend

AEW-028 already carries two protocol connections, to AADP's Policy Decision Point / Policy Enforcement Point separation and to OWASP ACS's own admission that complete mediation of every consequential action is not guaranteed, both grounded in this desk's own direct reading of Ruflo's source. This record does not extend either link with n8n's own occurrence: the existing rationale for both already describes a specific code-level placement, this desk's own confirmation that Ruflo's check ran inside one handler and not inside the shared function every caller invokes, a specificity this record cannot state for n8n's own fix without a located diff. The architectural pattern the advisory names in general terms is already supported by the existing links; restating it without new source-level grounding would not sharpen either protocol connection.

What this record does not establish

This record does not claim CVE-2026-86996 was exploited against a real n8n deployment prior to disclosure, that its underlying code mechanism matches Ruflo's own isBlockedTool-versus-executeTool pattern at the level of a specific function or file, that every n8n deployment running an affected version actually used both the Execute Workflow node and the Agent tool path against the same restricted workflow, or that n8n's own "This workflow can be called by" setting carries no further caveats beyond what the advisory itself states about it, since this record could not independently fetch n8n's own documentation of that setting. Where the evidence available to this record does not establish a fact, this record states it as unknown rather than inferring it from Ruflo's own, differently verified occurrence.

Where this sits in the pattern

This desk's wider argument, that execution authority has to be evaluated against the action a system actually takes rather than assumed from an earlier, adjacent declaration, extends here to a caller policy a workflow owner configured specifically to narrow who could invoke a restricted workflow: that policy described only the path its own author built the check for, the Execute Workflow node, and a second, later-added way to reach the identical execution, an Agent using the workflow as a tool, inherited none of it. This occurrence, independently arising at a second vendor from Ruflo's own, is further evidence that a capability's enforcement gate wired to one caller instead of the shared executor every caller shares is a durable, cross-implementation architecture question, not a defect specific to any one product's own history.