Executive brief
n8n is a workflow automation platform that allows users to connect and automate various applications and services. The GraphQL node contains a flaw where connection errors expose decrypted credential secrets in stored execution logs that any authenticated user can access. This can lead to exposure of sensitive authentication information used by workflows.
Technical details
The GraphQL node re-throws underlying HTTP client errors without wrapping them in n8n's standard error handling type. When a connection-level failure occurs, the raw error object—containing live request headers with decrypted credential secrets—is persisted verbatim in execution data. The vulnerability requires authentication and assumes the attacker can access execution records, but imposes no other constraints (low attack complexity, network-reachable). The exposure allows authenticated users to retrieve decrypted credentials from stored run logs. Patches are available in versions 1.123.69, 2.33.4, and 2.34.1.
Affected products
- n8n n8n before 1.123.69, 2.33.4, and 2.34.1
Timeline
- 2026-08-20: disclosed
- 2026-08-20: patched: Fixed in versions 1.123.69, 2.33.4, and 2.34.1