Executive Summary

CVE-2026-45732 is a high-severity authorization bypass vulnerability in the n8n workflow automation platform. The issue occurs because the OAuth1 and OAuth2 credential reconnect endpoints incorrectly use the credential:read permission instead of the stricter credential:update permission to authorize access.

This flaw allows an authenticated user who only has read-only access to a shared credential to initiate an OAuth reconnect flow and overwrite the stored token material with tokens linked to an attacker-controlled external account.

As a result, workflows that rely on the affected credential will execute under the attacker's OAuth identity, enabling the attacker to exfiltrate data to external services and maintain persistent control over shared integrations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to unauthorized data exfiltration and persistent takeover of shared integrations within the n8n platform.

An attacker with read-only access to shared credentials can replace OAuth tokens with their own, causing workflows to run under the attacker's identity.

This means sensitive data processed by these workflows can be sent to attacker-controlled external services, potentially leading to data breaches and loss of control over automated processes.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by auditing shared credentials for unexpected OAuth token changes, as attackers may overwrite stored token material with tokens bound to an external account they control.

Since the issue involves OAuth1 and OAuth2 credential reconnect endpoints authorizing with read-only permissions instead of update permissions, monitoring logs for OAuth reconnect flows initiated by users with only read access may help identify exploitation attempts.

Specific commands are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting credential sharing to trusted users only.

Additionally, audit all shared credentials for any unexpected OAuth token changes to detect potential compromise.

Upgrading n8n to a fixed version such as 1.123.43, 2.20.7, or 2.21.1 is recommended to fully resolve the vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an attacker to overwrite stored OAuth tokens and execute workflows under the attacker's identity, enabling data exfiltration to external services and persistent takeover of shared integrations.

Such unauthorized access and potential data exfiltration could lead to violations of data protection regulations like GDPR and HIPAA, which require strict controls over access to sensitive data and the prevention of unauthorized data disclosure.

Therefore, affected systems may face compliance risks due to the possibility of unauthorized data access and leakage caused by this vulnerability.

Useful 0 Not Useful 0