CyberRota Analysis
AI-GeneratedVersions of n8n prior to 1.123.69, 2.33.4, and 2.34.1 are vulnerable to an information disclosure flaw in the GraphQL node, where connection-level errors expose sensitive HTTP headers, including decrypted credential secrets. This can lead to unauthorized access to sensitive information by any authenticated user who can view the execution data. Organizations using affected versions should prioritize patching to mitigate the risk of credential leakage.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error unchanged instead of wrapping it in n8n's standard error type. That error contains the live request's headers, including a decrypted credential secret, which the execution engine persists verbatim. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret from the stored run data.
Related CVEs
Other vulnerabilities affecting the same vendor(s)