AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-6qc9-mqvw-jg7x: n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

highvulnerability

security

Source: GitHub Advisory DatabaseJuly 22, 2026

Summary

n8n (a workflow automation tool) had a security flaw where an authenticated user with edit access could steal another user's credentials by referencing them in an HTTP Request node and hiding the credential type in an expression (a formula that gets evaluated at runtime). The system checked permissions before resolving the expression, so it didn't catch that the user shouldn't have access to that credential, and the credential was loaded anyway when the workflow ran.

Solution / Mitigation

The issue has been fixed in n8n versions 1.123.67, 2.31.5, and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators can: restrict n8n instance access to fully trusted users only; exclude the HTTP Request node by adding `n8n-nodes-base.httpRequest` to the `NODES_EXCLUDE` environment variable if the node is not required; or audit credential sharing and workflow access to limit exposure of credential IDs to untrusted users. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.