Credential Exposure Vulnerability in n8n by n8n-io

CVE-2026-65599

What is CVE-2026-65599?

A vulnerability in n8n creates the possibility of credential exposure when configured with Google Service Account credentials. In affected versions prior to 1.123.64, 2.29.8, and 2.30.1, the full PEM private key was insecurely included in the 'kid' field of the JWT header, which is only meant for key identification. Since JWT headers are Base64-encoded and not encrypted, the private key can be easily extracted by anyone who logs or inspects the JWT. This exposure allows an attacker who retrieves the key to impersonate the service account, enabling access to and manipulation of any Google Cloud resources it can access.

References