CVE-2026-65599: Cleartext Storage of Sensitive Information in n8n-io n8n
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field (intended only for a key identifier). Because JWT headers are Base64-encoded rather than encrypted, the private key could be recovered by anything that logged or inspected the JWT. An attacker who obtained the key could impersonate the service account and access or modify any Google Cloud resource it was authorized to use. Only instances using Google Service Account credentials are affected.
AI Analysis
Technical Summary
The vulnerability in n8n occurs when configured with Google Service Account keys, where the full PEM private key is mistakenly placed in the JWT header's kid field instead of a key identifier. Since JWT headers are only Base64-encoded and not encrypted, this leads to cleartext exposure of sensitive credentials. An attacker who obtains the private key can impersonate the Google Service Account, potentially gaining unauthorized access to or control over Google Cloud resources authorized for that account. This affects only n8n instances using Google Service Account credentials. The issue is present in versions before 1.123.64, 2.29.8, and 2.30.1. The product is cloud-hosted, and the vendor manages remediation.
Potential Impact
Exposure of the Google Service Account private key allows attackers to impersonate the service account, leading to unauthorized access and modification of Google Cloud resources authorized for that account. This compromises the confidentiality and integrity of cloud resources accessible via the affected service account. The impact is limited to instances using Google Service Account credentials.
Mitigation Recommendations
The vendor manages remediation for this cloud-hosted service and a patch is available. Users should ensure their n8n instances are updated to versions 1.123.64, 2.29.8, 2.30.1 or later to mitigate this vulnerability. Check the vendor advisory for confirmation and apply the official fix promptly.
CVE-2026-65599: Cleartext Storage of Sensitive Information in n8n-io n8n
Description
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field (intended only for a key identifier). Because JWT headers are Base64-encoded rather than encrypted, the private key could be recovered by anything that logged or inspected the JWT. An attacker who obtained the key could impersonate the service account and access or modify any Google Cloud resource it was authorized to use. Only instances using Google Service Account credentials are affected.
CVSS v4.0
Score 5.1medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in n8n occurs when configured with Google Service Account keys, where the full PEM private key is mistakenly placed in the JWT header's kid field instead of a key identifier. Since JWT headers are only Base64-encoded and not encrypted, this leads to cleartext exposure of sensitive credentials. An attacker who obtains the private key can impersonate the Google Service Account, potentially gaining unauthorized access to or control over Google Cloud resources authorized for that account. This affects only n8n instances using Google Service Account credentials. The issue is present in versions before 1.123.64, 2.29.8, and 2.30.1. The product is cloud-hosted, and the vendor manages remediation.
Potential Impact
Exposure of the Google Service Account private key allows attackers to impersonate the service account, leading to unauthorized access and modification of Google Cloud resources authorized for that account. This compromises the confidentiality and integrity of cloud resources accessible via the affected service account. The impact is limited to instances using Google Service Account credentials.
Mitigation Recommendations
The vendor manages remediation for this cloud-hosted service and a patch is available. Users should ensure their n8n instances are updated to versions 1.123.64, 2.29.8, 2.30.1 or later to mitigate this vulnerability. Check the vendor advisory for confirmation and apply the official fix promptly.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-07-22T10:48:36.000Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
- Is Cloud Service
- true
Threat ID: 6a60ab959c2644c7f8eced78
Added to database: 07/22/2026, 11:37:57 UTC
Last enriched: 07/30/2026, 02:10:05 UTC
Last updated: 08/31/2026, 22:52:13 UTC
Views: 85
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.