GHSA-89gh-3pgc-v5h2: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

Summary

Custom HTTP headers set in credentials for certain LLM sub-nodes, including OpenAI, Anthropic, and Lemonade, are masked in the n8n UI but written in plaintext into execution data. Any authenticated user with access to an affected workflow's execution data can read the header names and values, which typically contain API keys or other secrets. Because execution data can be persisted to the database and exported, leaked values may remain accessible beyond a single execution.

Mitigation

Fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Upgrade to one of these versions or later. If upgrading is not immediately possible, restrict execution data access to fully trusted users only, avoid configuring custom headers in LLM node credentials, and rotate any API keys or secrets that may have been stored as custom header values in affected credentials. These workarounds do not fully remediate the risk.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmDeclares an LLM dependency

Related items

• HighCVE-2026-88968: Claude Code Edit tool symlink race overwrites files outside workspace on macOSSame vendor · NVD/CVE Database
• HighCVE-2026-88066: Claude Desktop on Windows git.exe execution via search pathSame vendor · NVD/CVE Database
• HighCVE-2026-62331: praktor path traversal via Telegram document upload filenamesSame vendor · NVD/CVE Database
• MediumCVE-2026-111372: AI ChatBot for WooCommerce WoowBot plugin authorization bypass in RAG syncSame vendor · NVD/CVE Database
• MediumGHSA-w4fh-qvv9-3v23: Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource serverSame vendor · GitHub Advisory Database