Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.1

n8n Exposes API Keys and Secrets in Workflow Records

published 3 months ago
Summary

Old versions of n8n store API keys and secrets in plain text, allowing users with access to view sensitive information. This is a serious security risk that needs to be addressed. To fix this, update n8n to version 1.123.64 or later.

What to do
  • Update GitHub Actions n8n to version 1.123.64 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions n8n < 1.123.64
Original advisory text
Duplicate Advisory: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data
## Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-89gh-3pgc-v5h2. This link is maintained to preserve external references.

## Original Description

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.1 Medium
Type
CWE-532Insertion of Sensitive Information into Log File
Timeline
Published22 Jul 2026
Updated22 Jul 2026
First seen22 Jul 2026
Sources
GHSA-fmvg-vhqq-r2mj · GHSA
Track software like this
Free during beta