Executive brief
n8n is an automation platform that allows users to build workflows connecting various services and APIs. An authenticated user with edit access to a shared workflow could exploit a flaw in the HTTP Request node to access and exfiltrate credentials belonging to other users by bypassing permission checks through the use of expressions. This could lead to unauthorized access to sensitive APIs and data sources integrated with n8n.
Technical details
The vulnerability is an authorization bypass (CWE-863) in the HTTP Request node's `genericAuthType` parameter handling. When a user specifies the credential type via an expression, the pre-execution permission check compared the unresolved expression string rather than evaluating it to determine the actual credential type. This allowed the ownership verification to be skipped, and the correct credential was only loaded during execution time. The attacker must be authenticated with edit access to a shared workflow and must know the target credential's ID. The vulnerability affects all versions prior to 1.123.67, 2.31.5, and 2.32.1, and has been patched in those versions.
Affected products
- n8n n8n < 1.123.67, < 2.31.5, < 2.32.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched: Fixed in versions 1.123.67, 2.31.5, and 2.32.1