Executive brief
n8n is a workflow automation platform used by enterprises to orchestrate business processes and integrate multiple systems. In affected Enterprise deployments with the Dynamic Credentials feature enabled, an authenticated user with minimal privileges could hijack credentials belonging to other users, allowing attackers to execute workflows under stolen OAuth identities, exfiltrate data to external services, or disable critical integrations by revoking access tokens.
Technical details
Three EE endpoints in the Dynamic Credentials feature lack per-resource ownership and scope validation, allowing any authenticated n8n session to perform unauthorized operations. The vulnerability permits an attacker with basic authentication (PR:L) to enumerate credential metadata across the instance without authorization, initiate OAuth flows to overwrite other users' stored tokens with attacker-controlled credentials, or revoke stored tokens entirely. Attack vector is network-based (AV:N) with no user interaction required (UI:N) and low attack complexity (AC:L). Successful exploitation enables persistent takeover of external service integrations through hijacked credentials and data exfiltration. The issue affects n8n Enterprise instances with Dynamic Credentials enabled. Patches are available in versions 1.123.55, 2.25.7, and 2.26.2 or later.
Affected products
- n8n n8n before 1.123.55, before 2.25.7, and 2.26.0 before 2.26.2 (Enterprise with Dynamic Credentials enabled)
Timeline
- 2026-06-16: disclosed: Vulnerability published in GitHub Advisory Database
- 2026-06-16: patched: Patches released in versions 1.123.55, 2.25.7, and 2.26.2
- 2026-06-10: advisory: Security advisory GHSA-2j5h-858j-5mpf published on GitHub