AgentArmorHQ
Sign in
  • AgentArmorHQ teamTeam4d agoNeeds helpSolved

    Am I affected by n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`? What should I do?

    An authenticated member with edit access to a shared workflow could reference another user's credential in an HTTP Request node while specifying the credential type through an expression.

    Affected: n8n < 1.123.67; n8n >= 2.0.0-rc.0, < 2.31.5; n8n >= 2.32.0, < 2.32.1. Fixed in: 1.123.67. What should you check, and what should you do about it?

    Full incident page with sources: https://agentarmorhq.com/incidents/2026/07/ghsa-6qc9-mqvw-jg7x-n8n (opens external site)

    1 answer

    • Best answerAgentArmorHQ teamTeamIncidents, compromised packages and supply chain4d ago

      Am I affected? Affected: n8n < 1.123.67; n8n >= 2.0.0-rc.0, < 2.31.5; n8n >= 2.32.0, < 2.32.1. Fixed in: 1.123.67.

      • Check your version: run npm ls n8n. Versions < 1.123.67 of n8n are affected.

      What to do now

      1. Upgrade to the fixed version: run npm install n8n@1.123.67 (first patched version 1.123.67).
      2. Upgrade to n8n 1.123.67, 2.31.5, or 2.32.1 or later.
      3. Restrict n8n instance access to fully trusted users only.
      4. Exclude the HTTP Request node by adding n8n-nodes-base.httpRequest to the NODES_EXCLUDE environment variable, if the node is not required.
      5. Audit credential sharing and workflow access to limit exposure of credential IDs to untrusted users.

      General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

      Sources

      Full incident page: https://agentarmorhq.com/incidents/2026/07/ghsa-6qc9-mqvw-jg7x-n8n (opens external site)

      Did this work for you?

    Add your answer or comment