Summary
A path traversal vulnerability in the n8n node allows crafted resource identifiers to redirect API requests to unintended resources. An attacker who can submit or influence these identifiers may access workflows, executions, and credential secrets within the permissions of the associated API key.
Affected context
The vulnerability occurs in n8n deployments using affected versions and the n8n node to resolve API resources. It becomes risky when resource identifiers are accepted from an attacker-controlled source without sufficient validation or normalization before being used to construct or route API requests. The accessible data depends on the privileges associated with the API key.
Exploit preconditions
- Attack surface: n8n node resource-resolution and API request handling
- Required access: Ability to submit, modify, or influence a resource identifier processed by the node, plus an API key or execution context that permits the request
- Trigger point: Processing of a maliciously crafted resource ID
- Why exploitation is possible: Resource identifiers are not adequately validated, allowing traversal-style values to redirect requests beyond the intended resource boundary
Why this happens
The underlying issue is insufficient validation of resource identifiers before they are used to select or construct API targets. When an application treats attacker-controlled identifiers as trusted path-like values, traversal sequences or equivalent alternate references may escape the intended resource scope. This behavior maps to CWE-22: Improper Limitation of a Pathname to a Restricted Directory, applied here to API resource routing and authorization boundaries.
Potential impact
- An attacker may access workflows outside the intended resource
- Execution data may be disclosed or retrieved without authorization
- Credential secrets within the API key's scope could be exposed
- API requests may be redirected to unintended resources
- The confidentiality of n8n automation data may be reduced
General mitigation guidance
Mitigation generally focuses on treating resource identifiers as untrusted input and enforcing resource-boundary checks before making API requests.
Common defensive patterns include:
- Allowing only canonical, schema-conforming resource identifiers
- Normalizing and rejecting traversal or alternate-reference forms before resolution
- Binding identifier validation to the expected resource type and tenant or project scope
- Rechecking authorization after resource resolution rather than relying only on the original identifier
- Using narrowly scoped API keys and least-privilege service accounts
- Avoiding error responses that reveal whether unintended resources exist
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules that identify path or resource construction from untrusted identifiers
- Code review checks for missing canonicalization, allowlisting, or post-resolution authorization
- Tests covering traversal sequences, encoded variants, alternate separators, and cross-scope identifiers
- API gateway and application logs showing unusual resource IDs or repeated access across resource boundaries
- Policy enforcement requiring resource identifiers to conform to strict schemas before routing
- Automated security review tools that flag unvalidated path-like input and authorization gaps
