CyberRota Analysis
AI-GeneratedAn authorization bypass vulnerability exists in n8n versions prior to 1.123.80 and from 2.0.0 before 2.39.6, allowing attackers to exploit the credential test endpoint by specifying arbitrary project IDs. This flaw enables the exfiltration of sensitive project-scoped variables to unauthorized hosts, posing a significant risk to data confidentiality. Organizations using affected n8n versions should prioritize immediate updates to mitigate potential data breaches.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain an authorization bypass vulnerability in the credential test endpoint that resolves project-scoped variables without validating caller access. Attackers can specify an arbitrary project ID in the request body to interpolate sensitive variables into credential test requests sent to attacker-controlled hosts for exfiltration.