Summary
A credential tampering vulnerability in n8n allows duplicate node IDs and mismatched node name checks to bypass workflow credential protections. An attacker with editor access to a shared workflow may retain a victim's credentials and redirect associated secrets to attacker-controlled hosts.
Affected context
The issue affects n8n deployments that allow users with editor permissions to modify shared workflows and rely on node identifiers and names to enforce credential tamper protections. Risk is present when duplicate node IDs can be introduced and validation does not consistently bind authorization checks to the intended workflow node.
Exploit preconditions
- Attack surface: Shared workflow editing and credential-handling logic - Required access: Editor access to a workflow containing or using credentials - Trigger point: Workflow modification followed by credential or node validation - Why exploitation is possible: Duplicate identifiers and mismatched node
identity fields can cause tamper checks to evaluate the wrong workflow object,
allowing protected credential associations to persist or be redirected
Why this happens
The vulnerability results from authorization logic that does not reliably associate a node's identity with its complete, trusted workflow context. When duplicate node IDs and separately matched node names are accepted, attacker-controlled data can influence which object a credential tamper guard validates. This behavior maps to CWE-639, Authorization Bypass Through User-Controlled Key, because user-controlled identifiers can undermine an authorization decision.
Potential impact
- Victim credentials may be retained in a modified shared workflow
- Secrets may be sent to attacker-controlled hosts
- Connected services or data sources could be accessed using exposed credentials
- Workflow integrity and confidentiality may be compromised
- Downstream systems could be affected through unauthorized credential use
General mitigation guidance
Mitigation generally focuses on making workflow identity and credential authorization unambiguous. Secure-by-default designs should use immutable, server-assigned identifiers, reject duplicate node IDs, and bind credential checks to canonical object identity rather than independently supplied names. Validation should occur before credentials are retained or workflow changes are activated. Reduce input trust by normalizing and validating workflow structures at the trust boundary, restrict editor permissions to the minimum required scope, and isolate credentials from users who do not need to manage them. Audit and approval controls for shared workflow changes can further limit exposure.
How teams detect issues like this
Detection approaches can include static analysis for authorization decisions based on user-controlled identifiers, duplicate-key or duplicate-ID handling, and comparisons that use names separately from canonical object identity. Code review should look for workflow mutation paths that preserve credentials before complete validation, inconsistent identifier matching, and missing uniqueness enforcement. Runtime policy checks can flag shared workflow changes, credential references, and outbound destinations that differ from approved values. Automated security review tools may help identify these patterns during development.
