CVE-2026-54305 Overview
CVE-2026-54305 is a broken access control vulnerability in n8n, an open source workflow automation platform. Three Enterprise Edition (EE) endpoints supporting the Dynamic Credentials feature accepted any authenticated n8n session without verifying per-resource ownership or scope on the target workflow or credential. An authenticated user without project membership or credential sharing could enumerate credential metadata, hijack OAuth tokens, or revoke another user's stored credentials. The flaw is tracked under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Fixes are available in versions 1.123.55, 2.25.7, and 2.26.2.
Critical Impact
Authenticated low-privilege users can hijack OAuth credentials belonging to other tenants, redirect workflow executions to attacker-controlled identities, and exfiltrate data through compromised integrations.
Affected Products
- n8n versions prior to 1.123.55
- n8n versions prior to 2.25.7
- n8n versions prior to 2.26.2
Discovery Timeline
- 2026-06-23 - CVE-2026-54305 published to NVD
- 2026-06-23 - Last updated in NVD database
- Vendor advisory published at GitHub Security Advisory GHSA-2j5h-858j-5mpf
Technical Details for CVE-2026-54305
Vulnerability Analysis
The vulnerability resides in three Enterprise Edition endpoints that power the Dynamic Credentials feature in n8n. These endpoints validated that the caller held an authenticated session but failed to verify whether the caller owned, was shared on, or had project-level access to the referenced workflow or credential. As a result, any authenticated user could reference arbitrary credential and workflow identifiers belonging to other tenants on the same instance.
The impact spans confidentiality, integrity, and availability. Attackers can enumerate credential identifiers, names, and types referenced by any private workflow. They can initiate an OAuth authorization flow against another user's credential and overwrite stored tokens with tokens bound to an account the attacker controls. Attackers can also revoke another user's credential tokens, breaking dependent workflows.
Once a credential is hijacked, any workflow executing against it runs under the attacker's OAuth identity. This enables persistent integration takeover and silent data exfiltration to attacker-controlled external services such as cloud storage, messaging platforms, or SaaS APIs connected through n8n.
Root Cause
The root cause is missing per-resource authorization checks. The endpoints relied solely on session authentication and did not enforce ownership, sharing, or project scope checks against the workflow or credential identifiers supplied in the request.
Attack Vector
Exploitation requires network access to the n8n web interface and a valid low-privilege account on the instance. No user interaction by the victim is required. The attacker submits crafted requests to the vulnerable EE endpoints referencing target credential or workflow IDs harvested through enumeration. See the vendor advisory for endpoint specifics.
Detection Methods for CVE-2026-54305
Indicators of Compromise
- Unexpected OAuth re-authorization events on credentials, particularly token rotations originating from non-owner user sessions.
- Workflow executions producing data sent to previously unseen external endpoints or accounts.
- Sudden credential revocation events affecting workflows owned by other users or projects.
- Authenticated API calls to Dynamic Credentials EE endpoints referencing credential or workflow IDs outside the caller's project membership.
Detection Strategies
- Audit n8n application logs for requests to Dynamic Credentials endpoints where the requesting user has no sharing relationship with the referenced resource.
- Correlate OAuth token issuance and revocation events with the originating n8n user account and compare against credential ownership records.
- Review workflow execution logs for behavior changes following recent credential modifications.
Monitoring Recommendations
- Enable verbose audit logging on n8n and forward events to a centralized SIEM for retention and correlation.
- Alert on cross-tenant access patterns where a user references credential IDs from projects they do not belong to.
- Monitor outbound traffic from n8n workers for connections to unfamiliar OAuth endpoints or third-party APIs.
How to Mitigate CVE-2026-54305
Immediate Actions Required
- Upgrade n8n to 1.123.55, 2.25.7, or 2.26.2 depending on the deployed release branch.
- Rotate all OAuth credentials configured in n8n and re-authorize integrations from trusted accounts.
- Review workflow execution history for anomalous activity that may indicate hijacked credential usage.
- Restrict instance access to trusted users until patching is complete.
Patch Information
The vendor fixed the vulnerability in n8n versions 1.123.55, 2.25.7, and 2.26.2. Patches add per-resource ownership and scope checks to the affected Dynamic Credentials EE endpoints. Refer to the GitHub Security Advisory GHSA-2j5h-858j-5mpf for full remediation details.
Workarounds
- Limit account provisioning on the n8n instance to trusted users until the patch is applied.
- Place the n8n web interface behind an authenticating reverse proxy or VPN to reduce the attacker pool.
- Disable or restrict Enterprise Edition Dynamic Credentials functionality if not in active use.
# Upgrade n8n via npm to a patched release
npm install -g n8n@2.26.2
# Or pull the patched Docker image
docker pull n8nio/n8n:2.26.2
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:2.26.2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
