n8n LLM Sub-Node Credential Header Plaintext Leak

Technical Analysis

The vulnerability arises because n8n's credential masking is applied only at the UI rendering layer, while the underlying execution engine logs raw request headers—including custom Authorization or API-key headers configured in LLM node credentials—into persisted execution data. An authenticated user with read access to workflow execution history (not necessarily the workflow owner or an admin) can inspect or export this data to obtain plaintext secrets. This crosses a trust boundary between the workflow author who configured the credential and any other authenticated instance user, and it also creates a downstream supply-chain risk since leaked LLM provider API keys could be reused to impersonate the organization's agent, run unauthorized model calls, or pivot into other connected systems. The flaw does not require agent misbehavior or prompt injection; it is a data-handling and logging defect in the automation framework that happens to sit directly upstream of LLM/agent tool invocations.

Affected Systems

n8n

Detection Signatures

• Execution data/logs containing full HTTP header dumps for LLM sub-node HTTP requests
• Presence of Authorization, x-api-key, or custom auth header values in plaintext within stored/exported execution JSON
• Workflows using OpenAI, Anthropic, or Lemonade credential types with custom headers enabled
• Unusually broad user access to execution history/export endpoints on n8n instances

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 1.123.64, 2.29.8, 2.30.1, or later where the masking fix is applied.

2. 2

   Restrict execution data access

   Limit which users/roles can view or export workflow execution data, especially for workflows containing LLM credentials.

3. 3

   Rotate exposed credentials

   Rotate any API keys or secrets that were configured as custom headers in affected LLM sub-node credentials.

4. 4

   Avoid custom header auth where possible

   Use built-in authentication mechanisms for LLM credentials instead of custom headers until upgraded.

5. 5

   Audit historical execution logs

   Review and purge/redact stored execution data that may already contain leaked plaintext secrets.