GHSA-9r8p-h6cc-6qhm: n8n: Google Service Account Private Key Exposed in JWT Header
Summary
n8n, a workflow automation tool, accidentally exposed Google Service Account private keys in JWT headers (the unencrypted metadata attached to authentication tokens). Because JWT headers were only Base64-encoded (a simple encoding, not encryption), attackers could extract these keys and impersonate the service account to access Google Cloud resources. Only instances using Google Service Account credentials were affected.
Solution / Mitigation
The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later. If upgrading is not immediately possible, administrators should avoid using Google Service Account credentials until patched, rotate any exposed Google Service Account keys, and review proxy, load balancer, and application logs for JWT headers containing exposed key material.
Vulnerability Details
EPSS: 0.0%
Yes
July 22, 2026
Classification
Taxonomy References
Affected Vendors
Affected Packages
Related Issues
CVE-2026-63086: text-generation-inference through 3.3.7 contains a server-side request forgery (SSRF) vulnerability in the OpenAI-compat
CVE-2026-34371: LibreChat is a ChatGPT clone with additional features. Prior to 0.8.4, LibreChat trusts the name field returned by the e
Original source: https://github.com/advisories/GHSA-9r8p-h6cc-6qhm
First tracked: July 22, 2026 at 02:00 PM
Classified by LLM (prompt v3) · confidence: 85%