CVE-2026-65599: n8n Credential Exposure Vulnerability

CVE-2026-65599 Overview

CVE-2026-65599 is a credential exposure vulnerability in n8n, an open-source workflow automation platform. Affected versions place the full PEM private key of a configured Google Service Account into the JSON Web Token (JWT) kid header field, which is intended only to carry a key identifier. Because JWT headers are Base64-encoded rather than encrypted, any system that logs or inspects the token can recover the private key. An attacker who obtains the key can impersonate the service account and access or modify Google Cloud resources it is authorized to use. Only n8n instances using Google Service Account credentials are affected. The issue is classified under [CWE-312: Cleartext Storage of Sensitive Information].

Critical Impact
Recovery of a Google Service Account private key enables full impersonation of the account across any Google Cloud resource it can access.

Affected Products

n8n versions prior to 1.123.64
n8n versions prior to 2.29.8
n8n versions prior to 2.30.1

Discovery Timeline

2026-07-22 - CVE-2026-65599 published to NVD
2026-07-22 - Last updated in NVD database

Technical Details for CVE-2026-65599

Vulnerability Analysis

n8n integrates with Google Cloud services using Service Account credentials. To authenticate, n8n signs a JWT using the account's PEM private key and exchanges it for an OAuth 2.0 access token. In vulnerable versions, the credential handling code populates the JWT header's kid (key ID) claim with the entire PEM-encoded private key instead of the short key identifier string.

JWT headers are not encrypted. They are Base64URL-encoded, so any process, log aggregator, proxy, or debugging tool that captures the token can trivially decode the header and extract the private key material. The confidentiality of the credential depends entirely on the JWT never being observed, which is not a realistic assumption for tokens transiting HTTP clients, logging pipelines, and error-handling paths.

Root Cause

The root cause is improper handling of sensitive material during JWT construction. The kid field is a string identifier per RFC 7515, but the affected code paths substituted the full PEM key content. This aligns with [CWE-312], where secret data is stored or transmitted in a location that is readable without decryption.

Attack Vector

Exploitation requires access to a location where the JWT is observable. Candidate sources include n8n application logs, reverse proxy access logs, outbound HTTP debug traces, error reports, and network captures. An attacker with high privileges on the host or telemetry pipeline decodes the header, extracts the PEM key, and reuses it outside n8n to mint tokens for the compromised Google Service Account. Google Cloud will accept the tokens as legitimate because the signature is valid.

No verified public exploit code is available. The vulnerability mechanism is described in the GitHub Security Advisory and the VulnCheck Security Advisory.

Detection Methods for CVE-2026-65599

Indicators of Compromise

JWT strings in logs whose Base64URL-decoded header contains the literal substring -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----.
Google Cloud audit log entries showing Service Account activity originating from IP addresses or user agents that do not match the n8n host.
Unexpected AccessToken requests to oauth2.googleapis.com outside normal n8n workflow schedules.

Detection Strategies

Scan historical application logs, proxy logs, and SIEM archives for Base64URL-encoded JWT headers containing PEM markers.
Correlate Google Cloud serviceAccount: identities used by n8n with source IPs and compare against the known n8n egress address.
Alert on any use of the n8n Service Account key outside expected API surfaces such as Drive, Sheets, or BigQuery calls tied to workflow IDs.

Monitoring Recommendations

Enable Google Cloud Audit Logs for Data Access on all resources reachable by the n8n Service Account and forward them to your SIEM.
Monitor n8n version strings against the fixed releases 1.123.64, 2.29.8, and 2.30.1 in asset inventories.
Track outbound TLS destinations from n8n hosts and flag connections that reuse Google credentials from non-n8n workloads.

How to Mitigate CVE-2026-65599

Immediate Actions Required

Upgrade n8n to 1.123.64, 2.29.8, or 2.30.1 or later, matching your deployment channel.
Rotate every Google Service Account key that was configured in an affected n8n instance, then delete the old key in the Google Cloud IAM console.
Review Google Cloud audit logs for the affected Service Accounts covering the full period the vulnerable version was in use.
Purge or restrict access to any log store that may have captured JWTs generated by n8n Google credential nodes.

Patch Information

Fixes are available in n8n 1.123.64, 2.29.8, and 2.30.1. The patched versions populate the JWT kid field with a key identifier only and no longer include PEM material in headers. Refer to the GitHub Security Advisory GHSA-9r8p-h6cc-6qhm for release notes.

Workarounds

Replace Google Service Account credentials with OAuth 2.0 user credentials in n8n until upgrade is possible.
Apply least privilege to Service Accounts used by n8n so a compromised key exposes the smallest possible resource set.
Restrict Service Account key usage by IP with Google Cloud VPC Service Controls or context-aware access policies.

bash

# Verify installed n8n version and confirm it is patched
n8n --version

# Rotate a compromised Google Service Account key using gcloud
gcloud iam service-accounts keys create new-key.json \
  --iam-account=n8n-runner@PROJECT_ID.iam.gserviceaccount.com

gcloud iam service-accounts keys delete OLD_KEY_ID \
  --iam-account=n8n-runner@PROJECT_ID.iam.gserviceaccount.com