PatchSiren cyber security CVE debrief
CVE-2026-65599 n8n-io CVE debrief
The n8n workflow automation tool contains a credential exposure vulnerability in versions before 1.123.64, 2.29.8, and 2.30.1. When configured with a Google Service Account key, the full PEM private key was mistakenly placed in the JWT header's kid field. This field is intended only for a key identifier. Because JWT headers are Base64-encoded rather than encrypted, the private key could be recovered by anything that logged or inspected the JWT.
- Vendor
- n8n-io
- Product
- n8n
- CVSS
- MEDIUM 5.1
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-07-22
- Original CVE updated
- 2026-07-22
- Advisory published
- 2026-07-22
- Advisory updated
- 2026-07-22
Who should care
Users of n8n workflow automation tool versions before 1.123.64, 2.29.8, and 2.30.1 who utilize Google Service Account credentials should be aware of this vulnerability. An attacker who obtained the key could impersonate the service account and access or modify any Google Cloud resource it was authorized to use.
Technical summary
The vulnerability exists in n8n versions before 1.123.64, 2.29.8, and 2.30.1. The full PEM private key of a Google Service Account was mistakenly included in the kid field of the JWT header. This field is meant for a key identifier only. Since JWT headers are Base64-encoded and not encrypted, the private key can be easily recovered from logs or inspections of the JWT. This exposure allows potential attackers to impersonate the service account, thereby gaining access to or modification capabilities for any Google Cloud resource the service account is authorized for.
Defensive priority
Instances using Google Service Account credentials with affected n8n versions should prioritize remediation.
Recommended defensive actions
- Inventory and verify n8n versions in use.
- Upgrade to n8n version 1.123.64, 2.29.8, or 2.30.1 or later.
- Review and rotate any exposed Google Service Account keys.
- Implement compensating controls such as monitoring for suspicious activity related to Google Cloud resources.
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
- Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
- Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
Evidence notes
The CVE record was published on 2026-07-22T12:18:20.167Z and has not been modified since then. The NVD entry is currently Undergoing Analysis. This vulnerability affects n8n workflow automation tool versions before 1.123.64, 2.29.8, and 2.30.1. Users should verify their deployments and review official advisories for affected scope and vendor guidance.
Official resources
AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-22T12:18:20.167Z and has not been modified since then. The NVD entry is currently Undergoing Analysis.