CVE-2026-65599

Analyzed Analyzed - Analysis Complete

Credential Exposure in n8n via JWT Private Key in kid Field

Publication date: 2026-07-22

Last updated on: 2026-07-27

Assigner: VulnCheck

Description

n8n versions before 1.123.64, 2.29.8, and 2.30.1 contain a credential exposure vulnerability: when configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field (intended only for a key identifier). Because JWT headers are Base64-encoded rather than encrypted, the private key could be recovered by anything that logged or inspected the JWT. An attacker who obtained the key could impersonate the service account and access or modify any Google Cloud resource it was authorized to use. Only instances using Google Service Account credentials are affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-22

Last Modified

2026-07-27

Generated

2026-08-11

AI Q&A

2026-07-22

EPSS Evaluated

2026-08-10

NVD

CVE-2026-65599

EUVD

EUVD-2026-47643

Affected Vendors & Products

Vendor	Product	Version / Range
n8n	n8n	to 1.123.64 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.29.8 (exc)
n8n	n8n	to 1.123.64 (exc)
n8n	n8n	From 2.0.0 (inc) to 2.29.8 (exc)
n8n	n8n	2.30.0
n8n	n8n	2.30.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-312	The product stores sensitive information in cleartext within a resource that might be accessible to another control sphere.

Attack-Flow Graph

Executive Summary

This vulnerability affects n8n versions before 1.123.64, 2.29.8, and 2.30.1. When configured with a Google Service Account key, the full PEM private key is mistakenly placed in the JWT header's kid field. Since JWT headers are Base64-encoded and not encrypted, the private key can be recovered by anyone inspecting or logging the JWT.

Detection Guidance

To detect this vulnerability, inspect JWT headers in logs or network traffic for any n8n instances using Google Service Account credentials. Look for Base64-encoded data in the kid field that resembles a PEM private key format (-----BEGIN PRIVATE KEY-----). Check n8n logs for JWT tokens or inspect network requests involving n8n APIs.

Impact Analysis

An attacker who obtains the exposed private key could impersonate the service account and access or modify any Google Cloud resources it was authorized to use. This could lead to unauthorized data access, modification, or deletion in Google Cloud services.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, potentially violating compliance requirements under GDPR, HIPAA, or other regulations that mandate strict access controls and data protection measures.

Mitigation Strategies

Upgrade n8n to versions 1.123.64, 2.29.8, or 2.30.1 or later. If immediate upgrade is not possible, avoid using Google Service Account credentials until patched. Rotate any exposed Google Service Account keys and review logs for previously exposed key material.

Hi! I’m here to help you understand CVE-2026-65599. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70