n8n Google Service Account Private Key Leak via JWT Header (kid field)
First seen Jul 22, 2026 · Updated Jul 22, 2026
This advisory is a withdrawn duplicate of GHSA-9r8p-h6cc-6qhm, describing an n8n bug where the full Google Service Account PEM private key was mistakenly written into the JWT header's 'kid' field instead of a key identifier. Since JWT headers are only Base64-encoded (not encrypted), anything that logs or inspects the token could recover the private key, allowing impersonation of the associated Google Cloud service account. Impact is limited to n8n instances configured with Google Service Account credentials, and the issue is fixed in versions 1.123.64, 2.29.8, and 2.30.1.
Technical Analysis
The n8n workflow automation platform, when using a Google Service Account credential for JWT-based authentication, incorrectly populated the 'kid' header field with the entire PEM-formatted private key rather than a short key ID string. Because JWT headers are merely Base64url-encoded (not encrypted or signed for confidentiality), any component that logs, proxies, caches, or inspects the generated JWT—such as HTTP logging middleware, API gateways, or third-party monitoring tools—could trivially decode the header and extract the raw private key. An attacker obtaining this key gains the ability to mint valid JWTs and impersonate the service account directly against Google Cloud APIs, bypassing n8n entirely, with access scoped to whatever GCP resources/roles the service account holds. This crosses a tool/credential boundary: a workflow-automation agent's credential handling flaw becomes a durable, exportable identity compromise against an external cloud provider.
Affected Systems
n8n
Detection Signatures
- Search logs/traces for JWT headers where the 'kid' field value is unusually long (>100 chars) or begins with '-----BEGIN PRIVATE KEY-----'
- Audit any system that logs full HTTP request/response headers for n8n Google API calls
- Monitor GCP audit logs for service account usage from unexpected IP ranges or at unusual volume
- Review n8n credential configuration for Google Service Account type prior to patched versions
Remediation Steps
- 1
Upgrade n8n
Update to n8n 1.123.64, 2.29.8, 2.30.1 or later, which fixes the JWT header field misuse.
- 2
Rotate exposed service account keys
Immediately rotate/revoke any Google Service Account private keys that were used with vulnerable n8n versions, since Base64 encoding provides no confidentiality.
- 3
Audit logs for exposure
Search historical logs, log aggregators, and monitoring systems for any recorded JWTs containing the private key material and purge/redact them.
- 4
Restrict service account permissions
Apply least-privilege IAM roles to Google Service Accounts used in n8n workflows to limit blast radius if a key is compromised.
- 5
Enable anomaly detection
Set up GCP audit log alerts for unusual service account activity such as access from new locations or unexpected API calls.
CVE / Advisory IDs
Industries Most Exposed
Respond to this threat
Pro subscribers get a full AI-generated incident-response playbook for this threat — detection, containment, eradication, and recovery steps — plus an unlimited AI Threat Advisor for questions about your environment.