UpHeron
All vulnerabilities

Servers and applications

GHSA-h59h-rf6m-7jp5

Workflow Activation Allows Trigger Nodes to Use Credentials the Publisher Cannot Access

Severity
Medium 5.3
Published
13 Nov 2026
Last changed
13 Nov 2026
Added to UpHeron
13 Nov 2026
Fixed in
1.123.96, 2.47.6, 2.48.3, 3.2.2
Attack
Over the network · Only under certain conditions · Needs a user account · No user action needed
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
Sources
Project advisories (GitHub)

Description

When a workflow was activated, n8n registered its trigger nodes with the connected services using the credentials set on those nodes. Activation did not check that the user publishing the workflow had access to those credentials. A member who knew the ID of another user's credential could activate a workflow whose trigger used it. n8n then created or deleted webhooks on the connected service with that credential's privileges, and delivered events from resources the member chose to the member's workflow.

From n8n-io/n8n's security advisory.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Restrict n8n instance access to fully trusted users only.
  • Audit active workflows for trigger nodes that use credentials owned by another user, and deactivate any that are not expected.
  • Review the webhooks registered on connected services such as GitLab and GitHub, and remove any that are not expected.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Workarounds as given by n8n-io/n8n's security advisory.

Affected software

SoftwareAffected versions
n8nServers and applications · github:n8n-io/n8n
  • Every version before 1.123.96
  • Every version before 3.2.2
  • Every version before 2.48.3
  • Every version before 2.47.6

References