CVE-2026-65599: Cleartext Storage of Sensitive Information in n8n-io n8n
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field (intended only for a key identifier). Because JWT headers are Base64-encoded rather than encrypted, the private key could be recovered by anything that logged or inspected the JWT. An attacker who obtained the key could impersonate the service account and access or modify any Google Cloud resource it was authorized to use. Only instances using Google Service Account credentials are affected.
AI Analysis
Technical Summary
This vulnerability in n8n occurs when configured with a Google Service Account key. The full PEM private key is mistakenly placed in the JWT header's kid field, which is intended only for a key identifier. Since JWT headers are Base64-encoded and not encrypted, the private key can be extracted by anyone who can log or inspect the JWT. An attacker with this key can impersonate the Google Service Account and gain unauthorized access to Google Cloud resources authorized for that account. The issue affects n8n versions prior to 1.123.64, 2.29.8, and 2.30.1. The vulnerability is relevant only to instances using Google Service Account credentials.
Potential Impact
Exposure of the Google Service Account private key allows attackers to impersonate the service account. This can lead to unauthorized access and modification of any Google Cloud resources that the service account is authorized to use. The vulnerability compromises the confidentiality and integrity of cloud resources managed via the affected n8n instances.
Mitigation Recommendations
The vendor manages remediation for this cloud-hosted service. A patch is available for affected versions (prior to 1.123.64, 2.29.8, and 2.30.1). Users should upgrade to these fixed versions or later. Since this is a cloud service, the vendor typically applies patches server-side; verify with the vendor advisory for current remediation status. Instances not using Google Service Account credentials are not affected.
CVE-2026-65599: Cleartext Storage of Sensitive Information in n8n-io n8n
Description
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field (intended only for a key identifier). Because JWT headers are Base64-encoded rather than encrypted, the private key could be recovered by anything that logged or inspected the JWT. An attacker who obtained the key could impersonate the service account and access or modify any Google Cloud resource it was authorized to use. Only instances using Google Service Account credentials are affected.
CVSS v4.0
Score 5.1medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in n8n occurs when configured with a Google Service Account key. The full PEM private key is mistakenly placed in the JWT header's kid field, which is intended only for a key identifier. Since JWT headers are Base64-encoded and not encrypted, the private key can be extracted by anyone who can log or inspect the JWT. An attacker with this key can impersonate the Google Service Account and gain unauthorized access to Google Cloud resources authorized for that account. The issue affects n8n versions prior to 1.123.64, 2.29.8, and 2.30.1. The vulnerability is relevant only to instances using Google Service Account credentials.
Potential Impact
Exposure of the Google Service Account private key allows attackers to impersonate the service account. This can lead to unauthorized access and modification of any Google Cloud resources that the service account is authorized to use. The vulnerability compromises the confidentiality and integrity of cloud resources managed via the affected n8n instances.
Mitigation Recommendations
The vendor manages remediation for this cloud-hosted service. A patch is available for affected versions (prior to 1.123.64, 2.29.8, and 2.30.1). Users should upgrade to these fixed versions or later. Since this is a cloud service, the vendor typically applies patches server-side; verify with the vendor advisory for current remediation status. Instances not using Google Service Account credentials are not affected.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-22T10:48:36.000Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a60ab959c2644c7f8eced78
Added to database: 07/22/2026, 11:37:57 UTC
Last enriched: 07/22/2026, 11:53:12 UTC
Last updated: 07/23/2026, 02:51:54 UTC
Views: 19
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.