n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition
High9.9CVE-2026-33663 · Published Mar 25, 2026
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| n8n npm | < 1.123.27 | 1.123.27 |
| >= 2.14.0, < 2.14.1 | 2.14.1 | |
| >= 2.0.0-rc.0, < 2.13.3 | 2.13.3 |
Details and references
## Impact An authenticated user with the `global:member` role could exploit chained authorization flaws in n8n's credential pipeline to steal plaintext secrets from generic HTTP credentials (`httpBasicAuth`, `httpHeaderAuth`, `httpQueryAuth`) belonging to other users on the same instance. The attack abuses a name-based credential resolution path that does not enforce ownership or project scope, combined with a bypass in the credentials permission checker that causes generic HTTP credential types to be skipped during pre-execution validation. Together, these flaws allow a member-role user to resolve another user's credential ID and execute a workflow that decrypts and uses that credential without authorization. Native integration credential types (e.g. `slackApi`, `openAiApi`, `postgres`) are not affected by this issue. This vulnerability affects Community Edition only. Enterprise Edition has additional permission gates on workflow creation and execution that independently block this attack chain. ## Patches The issue has been fixed in n8n versions 1.123.27, 2.13.3, and 2.14.1. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict instance access to fully trusted users only. - Audit credentials stored on the instance and rotate any generic HTTP credentials (`httpBasicAuth`, `httpHeaderAuth`, `httpQueryAuth`) that may have been exposed. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-639
- Also known as
- CVE-2026-33663
More n8n advisories
All n8n| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 25 | n8n has In-Process Memory Disclosure in its Task Runner CVE-2026-27496High6.5fixed in 1.123.22, 2.9.3, 2.10.1 | High6.5 | 1.123.22, 2.9.3, 2.10.1 |
| Mar 25 | n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode CVE-2026-33660Critical9.9fixed in 1.123.27, 2.13.3, 2.14.1 | Critical9.9 | 1.123.27, 2.13.3, 2.14.1 |
| Mar 25 | n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover CVE-2026-33665High8.2fixed in 1.121.0, 2.4.0 | High8.2 | 1.121.0, 2.4.0 |
| Mar 25 | n8n Has Authorization Bypass in OAuth Callback via N8N_SKIP_AUTH_ON_OAUTH_CALLBACK CVE-2026-33720Medium4.7fixed in 2.8.0 | Medium4.7 | 2.8.0 |
| Mar 25 | n8n Has External Secrets Authorization Bypass in Credential Saving CVE-2026-33722High6.3fixed in 1.123.23, 2.6.4 | High6.3 | 1.123.23, 2.6.4 |
| Mar 25 | n8n's Source Control SSH Configuration Uses StrictHostKeyChecking=no CVE-2026-33724Medium5.4fixed in 2.5.0 | Medium5.4 | 2.5.0 |