AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-2j5h-858j-5mpf: n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints

highvulnerability

security

Source: GitHub Advisory DatabaseJune 16, 2026CVE-2026-54305

Summary

n8n (a workflow automation tool) has a security flaw in its Enterprise Edition where three endpoints for the Dynamic Credentials feature (a system that manages authentication tokens across workflows) fail to check if users should have access to specific workflows or credentials. An authenticated attacker could steal another user's credential tokens, take over their integrations, or disable their credentials entirely, affecting any workflows that rely on those credentials.

Solution / Mitigation

The issue has been fixed in n8n versions 1.123.55, 2.25.7, and 2.26.2. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can temporarily restrict n8n instance access to fully trusted users only, or disable the Dynamic Credentials feature by unsetting `N8N_ENV_FEAT_DYNAMIC_CREDENTIALS`. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.