Alex Joseph
Unpacking the n8n Credential Exposure Vulnerability
A significant security flaw has been identified in certain versions of n8n, an open-source workflow automation platform. This vulnerability, tracked as CVE-2026-65599, centers around the unintentional exposure of Google Service Account private keys within JSON Web Token (JWT) headers. For organizations utilizing Google Service Account credentials with n8n, this issue could allow an attacker to gain unauthorized access to their Google Cloud resources.
In essence, the full private key of a Google Service Account was mistakenly placed into a part of the JWT header that is meant only for a key identifier. Because JWT headers are only encoded (not encrypted), this private key could be easily read by anyone who inspected or logged the JWT. If an attacker managed to get hold of such a JWT, they could use the exposed key to pretend to be the legitimate service account. This would grant them the power to access or change any Google Cloud resources that the service account was authorized to use.
CVE Details
- Product: n8n
- CVE ID: CVE-2026-65599
- Published Date: July 22, 2026
- Severity: MEDIUM (CVSS Score 6.5)
- Status: Analyzed
Affected Products
This vulnerability impacts n8n instances configured to use Google Service Account credentials. Specifically, the following versions are affected:
- n8n versions before 1.123.64 (for both community and enterprise editions)
- n8n versions before 2.29.8 (for both community and enterprise editions)
- n8n versions before 2.30.1 (for both community and enterprise editions)
It’s crucial to note that if your n8n instance does not use Google Service Account credentials, it is not affected by this particular vulnerability.
Current Status
The vulnerability CVE-2026-65599 has been officially Analyzed. This means the details of the flaw are understood and documented.
Severity Level
The vulnerability is rated as MEDIUM severity, with a CVSS score of 6.5. This classification highlights that while exploiting this flaw requires specific conditions (using Google Service Account credentials), a successful attack could lead to significant unauthorized access. An attacker could impersonate the service account, potentially leading to data breaches, unauthorized modifications of cloud resources, and other severe consequences within your Google Cloud environment.
Possible Solutions
The good news is that fixes are available. To protect your n8n instance from this credential exposure, you should update to the patched versions immediately:
- Upgrade to n8n version 1.123.64 or later.
- Upgrade to n8n version 2.29.8 or later.
- Upgrade to n8n version 2.30.1 or later.
Temporary Mitigations and Post-Patch Actions:
If an immediate upgrade isn’t feasible, consider these temporary steps, but remember they don’t fully eliminate the risk:
- Avoid Google Service Account Credentials: Temporarily stop using Google Service Account credentials with n8n until your instance is patched.
- Rotate Keys: Immediately rotate any Google Service Account keys that have been used with an affected n8n version. Assume these keys may have been compromised.
- Review Logs: Check your proxy, load balancer, and application logs for any JWT headers that might contain exposed key material. Treat any keys found in these logs as compromised.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-9r8p-h6cc-6qhm
https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-jwt-header
