Summary
An authorization bypass in n8n allows member users to use credentials that they are not authorized to access by omitting default node parameters. Affected workflows may pass decrypted credential values to attacker-controlled destinations when pre-execution checks fail to evaluate certain credential slots.
An authorization bypass in n8n allows member users to use credentials that they are not authorized to access by omitting default node parameters. Affected workflows may pass decrypted credential values to attacker-controlled destinations when pre-execution checks fail to evaluate certain credential slots.
Affected context
The issue affects n8n deployments where member users can create, save, or execute workflows containing nodes with credential-related parameters. Risk arises when default node parameters are omitted and workflow pre-execution authorization checks do not evaluate all credential slots before execution.
The issue affects n8n deployments where member users can create, save, or execute workflows containing nodes with credential-related parameters. Risk arises when default node parameters are omitted and workflow pre-execution authorization checks do not evaluate all credential slots before execution.
Exploit preconditions
- Attack surface: n8n workflow creation, storage, and execution
- Required access: A member-level account able to create or run workflows
- Trigger point: Workflow execution involving a node with omitted default parameters
- Why exploitation is possible: Authorization checks may skip credential slots when expected defaults are absent, allowing unauthorized credentials to be resolved and used
- Attack surface: n8n workflow creation, storage, and execution
- Required access: A member-level account able to create or run workflows
- Trigger point: Workflow execution involving a node with omitted default parameters
- Why exploitation is possible: Authorization checks may skip credential slots when expected defaults are absent, allowing unauthorized credentials to be resolved and used
Why this happens
The underlying flaw is an incomplete authorization decision caused by treating omitted default parameters as if no credential access required validation. When the workflow is saved or executed, the pre-execution checks do not consistently bind every credential reference to the requesting user's permissions. This behavior maps to CWE-863, which covers incorrect authorization decisions that permit access to protected functionality or data.
The underlying flaw is an incomplete authorization decision caused by treating omitted default parameters as if no credential access required validation. When the workflow is saved or executed, the pre-execution checks do not consistently bind every credential reference to the requesting user's permissions. This behavior maps to CWE-863, which covers incorrect authorization decisions that permit access to protected functionality or data.
Potential impact
- Unauthorized use of credentials available to other users
- Disclosure of decrypted credential values to attacker-chosen destinations
- Access to connected services or data sources
- Workflow-based data exfiltration or unauthorized actions
- Broader compromise of integrations reachable through exposed credentials
- Unauthorized use of credentials available to other users
- Disclosure of decrypted credential values to attacker-chosen destinations
- Access to connected services or data sources
- Workflow-based data exfiltration or unauthorized actions
- Broader compromise of integrations reachable through exposed credentials
General mitigation guidance
Mitigation generally focuses on enforcing authorization for every credential
reference, regardless of whether a node parameter is explicitly supplied or
omitted.
Common defensive patterns include:
- Applying server-side permission checks to all resolved credential slots
- Treating omitted, defaulted, and inherited parameters consistently during authorization
- Separating workflow-editing permissions from credential-use permissions
- Minimizing credential scope and integration privileges
- Preventing workflows from sending sensitive values to unapproved destinations
- Recording and reviewing credential resolution and workflow execution events
- Using secure-by-default workflow and credential-sharing policies
Mitigation generally focuses on enforcing authorization for every credential
reference, regardless of whether a node parameter is explicitly supplied or
omitted.
Common defensive patterns include:
- Applying server-side permission checks to all resolved credential slots
- Treating omitted, defaulted, and inherited parameters consistently during authorization
- Separating workflow-editing permissions from credential-use permissions
- Minimizing credential scope and integration privileges
- Preventing workflows from sending sensitive values to unapproved destinations
- Recording and reviewing credential resolution and workflow execution events
- Using secure-by-default workflow and credential-sharing policies
How teams detect issues like this
Organizations can look for this class of issue through:
- Static and semantic analysis of authorization checks around optional or defaulted parameters
- Code review signals where permission checks depend on client-supplied parameter presence
- Tests that compare authorization behavior for explicit, omitted, empty, and inherited values
- Integration tests covering member roles, shared credentials, and workflow execution
- Policy enforcement requiring server-side validation before credential resolution
- Audit monitoring for unusual credential use, workflow changes, and outbound transfers
Automated security review tools may help identify inconsistent authorization paths,
but role-aware behavioral testing is also important.
Organizations can look for this class of issue through:
- Static and semantic analysis of authorization checks around optional or defaulted parameters
- Code review signals where permission checks depend on client-supplied parameter presence
- Tests that compare authorization behavior for explicit, omitted, empty, and inherited values
- Integration tests covering member roles, shared credentials, and workflow execution
- Policy enforcement requiring server-side validation before credential resolution
- Audit monitoring for unusual credential use, workflow changes, and outbound transfers
Automated security review tools may help identify inconsistent authorization paths,
but role-aware behavioral testing is also important.
