Critical Privilege Escalation Flaw in n8n Exposes Dynamic Credentials to Unauthorized Access
Overview
A critical vulnerability in n8n's Dynamic Credentials feature allows authenticated users to enumerate sensitive credential information and overwrite OAuth tokens, enabling unauthorized access to protected resources. With a CVSS score of 9.9, this flaw poses a severe risk to organizations using affected versions.
Technical Analysis
The vulnerability stems from missing ownership and scope checks in three EE endpoints, enabling attackers to enumerate credential identifiers, initiate OAuth flows against other users' credentials, or revoke tokens. Exploitation requires no special privileges beyond basic authentication, with attack vectors involving crafted HTTP requests to targeted endpoints. This allows attackers to hijack credentials and execute workflows under their own OAuth identity.
Enterprise & DIB Impact
For DIB and enterprise environments, this flaw risks credential theft, unauthorized system access, and potential data exfiltration. Attackers could compromise sensitive workflows or supply chain integrations, undermining trust in automated processes and violating security policies around credential isolation.
Recommended Actions
- Upgrade n8n to versions 1.123.55
- 2.25.7
- or 2.26.2 immediately
- audit all workflows using Dynamic Credentials
- restrict access to credential management endpoints
- monitor for unauthorized OAuth token changes
Need Help Assessing Your Exposure?
Axiom Cyber Research provides vulnerability assessment, red team operations, and security advisory services to the Defense Industrial Base and regulated sectors.
Schedule a ConsultationFull security advisory on 247alerts.net →