Summary
An authorization bypass in n8n's credential test endpoint allows a caller to submit an arbitrary project identifier and resolve variables belonging to another project.
When those variables are interpolated into credential test requests sent to an attacker-controlled host, sensitive values may be disclosed. The issue becomes risky when the endpoint accepts user-controlled project references without verifying project access.
Affected context
The vulnerability occurs in n8n deployments where the credential test endpoint:
- Accepts a project identifier in the request body
- Resolves project-scoped variables during credential testing
- Does not confirm that the requesting user can access the specified project
- Can send the resulting request to a host controlled by the requester or an attacker
Exposure depends on endpoint availability, project isolation settings, and the sensitivity of variables accessible through credential testing.
Exploit preconditions
- Attack surface: The n8n credential test endpoint
- Required access: Access sufficient to invoke the endpoint, subject to deployment authentication and endpoint exposure
- Trigger point: A credential test request containing a user-controlled project identifier
- Why exploitation is possible: The endpoint resolves variables for the supplied project before enforcing effective project-level authorization, allowing cross-project data to enter an outbound request
Why this happens
The underlying flaw is an authorization failure caused by trusting a user-controlled object identifier when resolving project-scoped data.
The endpoint uses the supplied project ID to retrieve or interpolate variables without establishing that the caller is authorized for that project. This behavior maps to CWE-639: Authorization Bypass Through User-Controlled Key, because access control is not reliably enforced for a resource selected through attacker-influenced input.
Potential impact
- Sensitive project variables may be disclosed to an attacker-controlled host
- Credentials, tokens, or configuration secrets could be exposed
- Cross-project confidentiality boundaries may be weakened
- Attackers could use leaked values to access connected services
- Security monitoring may record the outbound request without identifying the original data exposure
General mitigation guidance
Mitigation generally focuses on enforcing authorization at the point where project-scoped variables are resolved.
Common defensive patterns include:
- Deriving the effective project from the authenticated session and permitted resource context
- Verifying project membership and authorization before reading or interpolating variables
- Rejecting arbitrary project identifiers that are not bound to the caller's authorized scope
- Applying strict allowlists for outbound credential-test destinations
- Minimizing secret interpolation and redacting sensitive values from test requests and logs
- Running integrations with least-privilege credentials and limiting cross-project data access
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules that flag resource lookups based directly on request identifiers without nearby authorization checks
- Code review of credential testing, variable interpolation, and project-scoped data access paths
- Tests that attempt cross-project access using valid identities and altered resource identifiers
- API policy checks requiring authorization decisions before secret resolution or outbound requests
- Network monitoring for credential-test requests containing unexpected sensitive values or unusual destinations
Automated code review and security testing tools may help identify missing object-level authorization checks, but should be complemented by authorization-focused integration tests.
