GHSA-pq6c-vh67-xpm3: Npm/n8n vulnerability
Impact
A log streaming event destination may reference a generic HTTP credential, and the destination resolved and decrypted whichever credential it named without checking that the caller had access to it. A user holding a custom global role scoped to Log Streaming operations could therefore name a credential belonging to another project and have its decrypted secret sent to an endpoint they controlled. The patch applies the standard credential access check when a destination resolves its credential.
Patches
The issue has been fixed in n8n versions 1.123.76, 2.37.7, and 2.38.2. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds
If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Audit and revoke any custom global roles that carry Log Streaming scopes (eventBusDestination:create, eventBusDestination:test, etc.), limiting those scopes to fully trusted users only. - Review existing Log Streaming event destinations for unexpected webhook URLs and remove any that are not recognized, then rotate any credentials that may have been referenced.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.76 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.37.7 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.38.2 - Configuration
Audit and revoke any custom global roles that carry Log Streaming scopes (e.g., eventBusDestination:create, eventBusDestination:test, etc.), limiting those scopes to fully trusted users only.
n8n Custom global roles (Log Streaming scopes: eventBusDestination:create, eventBusDestination:test, etc.) = limit to fully trusted users only - Compensating control
Restrict n8n instance access to fully trusted users only.
- Operational
Review existing Log Streaming event destinations for unexpected webhook URLs and remove any that are not recognized, then rotate any credentials that may have been referenced.
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with a custom global role that includes Log Streaming operations, such as eventBusDestination:create or eventBusDestination:test, can exploit it. The user must be able to configure a Log Streaming destination and point it at an endpoint they control.
What credentials are at risk?
Generic HTTP credentials belonging to another project may be exposed if their names are referenced by a Log Streaming event destination. The vulnerable destination resolution process decrypted the named credential without verifying that the caller was allowed to access it.
Are standard n8n permissions sufficient to trigger the issue?
The affected permission set is a custom global role with Log Streaming scopes. Administrators should audit and revoke those scopes from users who are not fully trusted.
What should be done if an upgrade cannot happen immediately?
Restrict instance access to fully trusted users, remove Log Streaming scopes from untrusted custom global roles, and inspect existing Log Streaming destinations for unrecognized webhook URLs. Remove suspicious destinations and rotate credentials that may have been exposed.
Which versions contain the fix?
Upgrade n8n to version 1.123.76, 2.37.7, or 2.38.2, or a later version.