Summary
A credential exposure vulnerability in n8n can send Wekan and Baserow usernames and passwords without encryption to attacker-controlled hosts. An attacker with permission to update credentials may alter the host field and bypass domain validation controls.
Affected context
The issue occurs in n8n credential integrations for Wekan and Baserow when a user who can update credentials is allowed to control or modify the destination host. Risk increases when host validation does not reliably constrain outbound credential transmission to approved domains and credentials are sent without encryption.
Exploit preconditions
- Attack surface: n8n credential-management functionality for Wekan or Baserow
- Required access: Permission to update the affected credentials
- Trigger point: Saving or using credentials after modifying the host field
- Why exploitation is possible: The supplied host can bypass domain validation, causing usernames and passwords to be transmitted in cleartext to an unvalidated destination
Why this happens
The underlying flaw is an insecure credential-handling pattern in which sensitive authentication data is transmitted without adequate confidentiality protection and the destination is not reliably restricted to trusted hosts. This maps to CWE-522: Insufficiently Protected Credentials, because account secrets may be exposed during transmission to an attacker-selected endpoint.
Potential impact
- An attacker may capture Wekan or Baserow account passwords
- Compromised credentials could enable unauthorized access to connected services
- Exposed secrets could be reused for account takeover or lateral movement
- Organizations could experience data disclosure, tampering, or service disruption
General mitigation guidance
Mitigation generally focuses on preventing credentials from being sent to untrusted destinations and ensuring confidentiality during transmission.
Common defensive patterns include:
- Enforcing strict allowlists for credential service hosts
- Validating normalized hostnames and rejecting unapproved destinations
- Requiring encrypted transport for all credential exchanges
- Limiting credential-update permissions according to least privilege
- Avoiding storage or transmission of reusable passwords where token-based authentication is available
- Auditing and rotating credentials that may have been exposed
How teams detect issues like this
Detection approaches may include:
- Static analysis for credential transmission paths that lack transport-security enforcement
- Code review checks for user-controlled host fields in authentication integrations
- Tests that verify domain validation cannot be bypassed through alternate host representations
- Network monitoring for authentication data sent to unapproved destinations
- Policy enforcement requiring approved endpoints and encrypted connections
- Automated security review tools that flag sensitive data flows and missing authorization checks
