AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-r4v6-9fqc-w5jr: n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay

highvulnerability

security

Source: GitHub Advisory DatabaseApril 29, 2026CVE-2026-42226

Summary

n8n (a workflow automation tool) had a security flaw where authenticated users could steal API keys belonging to other users by exploiting the `dynamic-node-parameters` endpoints (parts of the system that handle credential references). An attacker with access to a shared workflow could submit another user's credential ID and trick the backend into sending that credential to a server the attacker controls, allowing them to capture and reuse the stolen API key.

Solution / Mitigation

The issue has been fixed in n8n version 2.18.0. Users should upgrade to this version or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should restrict n8n access to fully trusted users only and avoid sharing workflows with users who should not have access to the credentials those workflows reference. The source notes these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.