CVE-2026-65599 Details
Description
n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field (intended only for a key identifier). Because JWT headers are Base64-encoded rather than encrypted, the private key could be recovered by anything that logged or inspected the JWT. An attacker who obtained the key could impersonate the service account and access or modify any Google Cloud resource it was authorized to use. Only instances using Google Service Account credentials are affected.
A credential exposure vulnerability has been identified in n8n versions prior to 1.123.64, 2.29.8, and 2.30.1. When n8n was configured with a Google Service Account key, the full PEM private key was inadvertently included in the JWT header's 'kid' field, which is meant only for key identifiers. Since JWT headers are Base64-encoded and not encrypted, the private key could be extracted by anything that logged or examined the JWT. An attacker who obtained the key could impersonate the service account and access or modify any Google Cloud resources it was authorized to use. This vulnerability affects only instances using Google Service Account credentials.
Users should upgrade to n8n versions 1.123.64, 2.29.8, or 2.30.1. If an immediate upgrade is not possible, administrators should avoid using Google Service Account credentials until the instance is patched, rotate any Google Service Account keys that may have been used with an affected n8n version, and review logs for JWT headers that could contain exposed key material.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/n8n-io/n8n/security/advisories/GHSA-9r8p-h6cc-6qhm | [email protected] | MitigationVendor Advisory |
| https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-jwt-header | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-312 | Cleartext Storage of Sensitive Information | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| n8n n8n | < 1.123.64 >= 2.0.0, < 2.29.8 2.30.0 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 27, 2026 | Initial Analysis | [email protected] |
| Jul 22, 2026 | CVE Modified | CISA-ADP |
| Jul 22, 2026 | New CVE Received | [email protected] |