n8n credential authorization bypass in HTTP Request node

Executive brief

n8n is a workflow automation tool used to connect various business applications. A security flaw allowed users with permission to edit shared workflows to access or steal sensitive credentials belonging to other users. This could lead to unauthorized access to third-party services and data connected to the n8n platform.

Technical details

An incorrect authorization vulnerability (CWE-863) exists in n8n's HTTP Request node. When the 'genericAuthType' is specified using an expression, the pre-execution permission check fails because it compares the unresolved expression string rather than the actual resolved credential type. This allows an authenticated attacker with edit access to a shared workflow to bypass ownership checks and load credentials belonging to other users, provided they know the target credential's identifier. The vulnerability has been patched in versions 1.123.67, 2.31.5, and 2.32.1.

Affected products

• n8n-io n8n < 1.123.67, >= 2.0.0-rc.0 < 2.31.5, >= 2.32.0 < 2.32.1

Timeline

• 2026-07-22: advisory: GitHub Advisory GHSA-6qc9-mqvw-jg7x published.
• 2026-07-22: patched: Fixes released in versions 1.123.67, 2.31.5, and 2.32.1.

References

• https://api.github.com/users/g4nkd
• https://github.com/g4nkd
• https://api.github.com/users/g4nkd/gists%7B/gist_id%7D
• https://api.github.com/users/g4nkd/repos
• https://avatars.githubusercontent.com/u/150204934?v=4
• https://api.github.com/users/g4nkd/events%7B/privacy%7D