n8n Log Streaming Broken Object-Level Authorization on Credential Decryption

Technical Analysis

The vulnerability lies in n8n's Log Streaming event destination resolution logic: when a destination references a generic-auth HTTP credential by ID, the backend decrypted that credential without verifying the requesting user's ownership or project-scoped access rights. An attacker holding a limited custom global role scoped only to Log Streaming operations (eventBusDestination:create, eventBusDestination:test) could point a destination at a credential ID belonging to another project, causing the decrypted secret to be transmitted to an attacker-controlled webhook. This crosses a trust boundary within the orchestration platform itself — a low-privilege automation-config role escalates to reading arbitrary stored secrets — which is significant in AI-agent contexts since n8n credentials often gate access to LLM API keys, vector databases, and other agent tool backends. The fix adds the standard credential access-control check at destination resolution time, closing the IDOR gap.

Affected Systems

n8n

Detection Signatures

• Log entries showing eventBusDestination:create or eventBusDestination:test actions by users outside expected admin roles
• Log Streaming destinations pointing to unrecognized or external webhook URLs
• Credential IDs referenced in Log Streaming configs that do not belong to the configuring user's project
• Sudden outbound HTTP requests from n8n log-streaming subsystem to unfamiliar domains
• Audit trail showing custom global roles with narrow eventBusDestination scopes accessing unrelated project credentials

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 1.123.76, 2.37.7, 2.38.2, or later, which enforce standard credential ownership checks when Log Streaming destinations resolve credentials.

2. 2

   Audit custom roles

   Review all custom global roles granting eventBusDestination:create/test scopes and restrict them to fully trusted administrators only.

3. 3

   Review event destinations

   Inspect existing Log Streaming event destinations for unrecognized webhook URLs or unexpected credential references and remove any suspicious configurations.

4. 4

   Rotate exposed credentials

   Rotate any generic-auth HTTP credentials that may have been referenced by unauthorized Log Streaming destinations, especially those gating LLM/API access used by agents.

5. 5

   Restrict instance access

   Until patched, limit n8n instance access to fully trusted users and monitor for anomalous Log Streaming configuration changes.