Sensitive Data Exposure in n8n: Custom Header Credential Values Leaked in Plaintext
Summary
GHSA-fmvg-vhqq-r2mj: Duplicate Advisory: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data. Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
n8n is an open-source workflow automation tool that allows users to connect various applications and services to automate tasks. It features a user-friendly interface and supports a wide range of integrations, making it a popular choice for developers and businesses looking to streamline their processes. However, versions prior to 1.123.64 have a critical vulnerability that exposes sensitive information through improper handling of custom HTTP header credentials.
Vulnerability Detail
The vulnerability arises from n8n versions before 1.123.64, which fail to properly mask custom HTTP header credentials in LLM sub-node execution data. This oversight results in plaintext API keys and secrets being written to workflow execution records. As a consequence, authenticated users with access to this execution data can read the exposed header values and credentials, which persist in the database and can be exported. This could lead to unauthorized access to sensitive information and potential exploitation of the affected systems.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can limit access to execution data by restricting user permissions within n8n. Ensure that only trusted users have access to sensitive workflows and execution records until the package is updated.
Conclusion
The vulnerability in n8n prior to version 1.123.64 poses a significant risk by exposing sensitive custom HTTP header credentials in plaintext. It is crucial for users to update to the latest version to protect against unauthorized access and potential data breaches. Implementing user permission restrictions can serve as a temporary workaround until the update is completed.
See every vulnerability recorded for n8n →
FAQ
All versions of n8n prior to 1.123.64 are affected by this vulnerability.
The vulnerability exposes custom HTTP header credentials, including API keys and secrets, in plaintext.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring signup.
The exposure of sensitive credentials can lead to unauthorized access to APIs and services, potentially resulting in data breaches and exploitation.
Yes, you can limit access to execution data by adjusting user permissions within n8n as a temporary measure.
Related vulnerabilities
Recent vulnerabilities recorded for n8n.
