Alex Joseph
Overview
A security flaw has been found in n8n, a popular workflow automation tool. This vulnerability could expose sensitive information, such as API keys and other secrets, when using certain Large Language Model (LLM) nodes with custom HTTP headers. While these credentials appear masked in the n8n user interface, they are unfortunately written in plain, unencrypted text into the workflow execution records. This means that anyone with authorized access to these execution records could potentially read your sensitive information, and this data might even remain accessible in the database or when exported.
This issue specifically impacts n8n instances where workflows are designed to use LLM sub-nodes (like those for OpenAI, Anthropic, or Lemonade) and have custom headers defined within their credentials.
CVE Details
Product Name: n8n
CVE ID: CVE-2026-65589
Published Date: July 22, 2026
Severity: Medium (CVSS Score: 6.5)
Status: Analyzed
Affected Products
The following n8n versions are known to be affected by this vulnerability:
- All n8n community editions before version 1.123.64
- All n8n enterprise editions before version 1.123.64
- All n8n community editions before version 2.29.8
- All n8n enterprise editions before version 2.29.8
- All n8n community editions before version 2.30.1
- All n8n enterprise editions before version 2.30.1
- Specifically, n8n community and enterprise versions 2.30.0 are also vulnerable.
Current Status
This vulnerability has been officially analyzed. Patches are available to address the issue, and users are strongly encouraged to upgrade their n8n installations to a fixed version as soon as possible.
Severity Level
The vulnerability is rated as Medium severity, with a CVSS score of 6.5. This classification indicates that while exploitation requires an authenticated user with access to execution data, the potential impact could be significant due to the exposure of sensitive credentials such as API keys and secrets. If compromised, these credentials could lead to unauthorized access to external services integrated with n8n.
Possible Solutions
To mitigate the risk of this vulnerability, it is crucial to update your n8n installation. The issue has been fixed in the following versions:
- n8n versions 1.123.64 and later
- n8n versions 2.29.8 and later
- n8n versions 2.30.1 and later
If an immediate upgrade is not feasible, consider these temporary workarounds:
- Restrict access: Limit access to workflow execution data to only fully trusted personnel.
- Avoid custom headers: Where possible, do not configure custom headers in LLM node credentials. Explore alternative, more secure authentication methods.
- Rotate secrets: Immediately rotate any API keys or secrets that might have been previously stored as custom header values in affected workflow credentials.
Remember, these workarounds are temporary and do not fully eliminate the risk. An upgrade to a patched version is the most effective solution.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2
https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-node-execution-data
