CVE-2026-86993: n8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check
n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP credential and decrypt whichever credential ID it named without an ownership check. A user with a custom global role carrying Log Streaming scopes could select a credential belonging to another project and send its decrypted secret to an attacker-controlled endpoint. The affected authorization boundary is packages/cli/src/modules/log-streaming.ee/destinations/destination-credentials-access.ts and the credential:read scope. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2
Event History
Frequently Asked Questions
Which users can exploit this issue?
An attacker needs an n8n account assigned a custom global role with Log Streaming scopes. They must also be able to configure a Log Streaming event destination and reference the ID of a generic HTTP credential owned by another project.
What information can be exposed?
The vulnerable destination credential handling can decrypt the referenced generic HTTP credential and send its secret to an attacker-controlled endpoint. The issue crosses project ownership boundaries because no ownership check is performed for the named credential.
Are standard configurations affected?
The described attack requires a custom global role carrying Log Streaming scopes. The provided information does not state that default roles have the required permissions.
What versions contain the fix?
Upgrade to n8n 1.123.76, 2.37.7, or 2.38.2 or later within the applicable release line. Versions before those releases are affected.
What can be done before upgrading?
Restrict Log Streaming scopes on custom global roles, particularly for users who should not be able to access credentials across projects. Review Log Streaming event destinations for references to generic HTTP credentials and attacker-controlled endpoints.