Executive brief
n8n is a low-code automation platform that allows users to configure log streaming to external endpoints using HTTP credentials. A flaw in access control allows users with log streaming permissions to decrypt and exfiltrate credentials belonging to other projects, potentially exposing API keys and authentication secrets to attacker-controlled endpoints. This could lead to unauthorized access to backend systems and data theft.
Technical details
The vulnerability is a missing authorization check (CWE-862) in n8n's log streaming event destination credential resolution. When a log streaming destination references a generic HTTP credential, the system resolves and decrypts the credential without verifying the caller has project-scoped access to it. An attacker with a custom global role holding log streaming scopes (`eventBusDestination:create`, `eventBusDestination:test`, etc.) can craft a request naming a credential from another project, causing the system to decrypt it and transmit the plaintext secret to an endpoint they control. Attack vector is network-based, requires high privilege (custom role grant), low complexity, and no user interaction. The fix applies standard credential access control checks during credential resolution. Patch versions: 1.123.76, 2.37.7, 2.38.2.
Affected products
- n8n n8n < 1.123.76, >= 2.0.0 and < 2.37.7, >= 2.38.0 and < 2.38.2
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Patches released in versions 1.123.76, 2.37.7, and 2.38.2