CVE-2026-65589 in n8n
Summary
by MITRE • 07/22/2026
n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/23/2026
This vulnerability affects n8n workflow automation platform versions prior to 1.123.64 and represents a critical information disclosure flaw that undermines the security of custom HTTP header authentication mechanisms. The issue stems from improper handling of sensitive credential data within LLM sub-nodes where plaintext API keys, secrets, and authentication tokens are written directly to execution records without adequate masking or obfuscation. This technical weakness creates a persistent exposure risk as credentials remain accessible in database storage and can be retrieved through normal workflow execution data access mechanisms.
The flaw operates at the data handling level within the platform's execution logging subsystem where sensitive header values flow through the system without proper sanitization. When authenticated users access execution data, they can directly read these exposed credentials from workflow records, effectively bypassing normal authentication controls for the specific resources protected by those headers. This vulnerability aligns with CWE-209 Information Exposure Through an Error Message and CWE-540 Information Exposure Through Persistent Storage, as it exposes sensitive data through both execution logging and database storage mechanisms. The persistence of these credentials in database records creates a long-term exposure window that extends beyond individual workflow executions.
From an operational impact perspective, this vulnerability enables attackers with minimal privileges to escalate their access within the platform by leveraging exposed API keys and authentication tokens stored in execution history. The risk is particularly severe for organizations using n8n to automate interactions with cloud services, APIs, and third-party systems where credentials grant access to valuable resources such as databases, cloud storage, or enterprise applications. Attackers can harvest these credentials from exported workflow data files or direct database queries, potentially gaining unauthorized access to systems that should remain protected by proper authentication mechanisms.
The mitigation strategy requires implementing comprehensive credential masking in execution logging for all HTTP header values that contain sensitive information. This includes developing automated sanitization processes that identify and replace credential values with placeholder text or hashes before writing execution data to persistent storage. Additionally, the platform should enforce access controls on execution history data to prevent unauthorized users from viewing potentially sensitive workflow information. Organizations should implement regular database audits to identify and remove previously exposed credentials, while also considering the implementation of credential rotation mechanisms for systems that may have been compromised through this vulnerability.
This vulnerability demonstrates the importance of proper input sanitization and output masking in workflow automation platforms where multiple services and external APIs are integrated. The attack pattern follows typical privilege escalation techniques described in MITRE ATT&CK framework under T1566 Credential Access and T1078 Valid Accounts, where attackers leverage exposed credentials to expand their access within the system. The remediation process should include comprehensive testing of execution logging mechanisms to ensure that no other sensitive data flows through similar pathways without proper protection measures.