Skip to content
AI Sec Watch
HighVulnerability

GHSA-m63j-689w-3j35: n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition

Source
GitHub Advisory(opens in a new tab)
Identifiers
CVE-2026-33663GHSA-m63j-689w-3j35
Published
Record updated
View JSON
Affected
  • n8n >= 2.0.0-rc.0, < 2.13.3, fixed in 2.13.3, released March 25, 2026, on the day of disclosure
  • n8n = 2.14.0, fixed in 2.14.1, released March 25, 2026, on the day of disclosure
  • n8n < 1.123.27, fixed in 1.123.27, released March 25, 2026, on the day of disclosure
Known exploitation
Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS
0.4%

Summary

An authenticated user with the global:member role can chain flaws in n8n's credential pipeline to steal plaintext secrets from generic HTTP credentials (httpBasicAuth, httpHeaderAuth, httpQueryAuth) owned by other users on the same instance. A name-based resolution path that does not enforce ownership or project scope, combined with a permission checker bypass that skips generic HTTP credential types during pre-execution validation, lets the attacker run a workflow that decrypts and uses another user's credential. Native integration credential types and Enterprise Edition are not affected.

Mitigation

The issue is fixed in n8n versions 1.123.27, 2.13.3, and 2.14.1; users should upgrade to one of these or later. If upgrading is not immediately possible, restrict instance access to fully trusted users only and audit stored credentials, rotating any generic HTTP credentials that may have been exposed. These workarounds do not fully remediate the risk and are short-term measures only.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

  • n8nnpmLLM dependency since 2026-02-10

Related items