DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-65599: CVE-2026-65599: Google Service Account Private Key Leakage via JWT Header Parameter in n8n

#security #cve #cybersecurity

CVE-2026-65599: Google Service Account Private Key Leakage via JWT Header Parameter in n8n

Vulnerability ID: CVE-2026-65599
CVSS Score: 5.1
Published: 2026-07-22

A credential exposure vulnerability in n8n (CVE-2026-65599) transmits the complete PEM-formatted Google Service Account private key in the 'kid' (Key ID) parameter of outbound JWT headers during Google API authentication. Because JWT headers are encoded in plain Base64URL and not encrypted, any entity that intercepts, logs, or processes these outbound requests can immediately extract the plaintext private key. This enables unauthorized third parties to fully compromise the corresponding Google Cloud Platform (GCP) service account and access any authorized cloud resources.

TL;DR

n8n leaked Google Service Account private keys inside the unencrypted 'kid' parameter of outbound JWT headers, permitting complete Google Cloud Platform resource compromise upon network or log exposure.

Technical Details

  • Vulnerability ID: CVE-2026-65599
  • CWE ID: CWE-312
  • Attack Vector: Network (AV:N)
  • CVSS v4.0 Score: 5.1 (Medium)
  • CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:L
  • Exploit Status: none
  • KEV Status: Not Listed

Affected Systems

  • n8n deployments running versions prior to 1.123.64
  • n8n deployments running versions prior to 2.29.8
  • n8n deployments running versions prior to 2.30.1
  • n8n: < 1.123.64 (Fixed in: 1.123.64)
  • n8n: < 2.29.8 (Fixed in: 2.29.8)
  • n8n: < 2.30.1 (Fixed in: 2.30.1)

Mitigation Strategies

  • Upgrade n8n immediately to a secure release version
  • Revoke and rotate all Google Service Account keys utilized on vulnerable n8n installations
  • Audit historical HTTP proxy logs and APM storage for leaked PEM-format data headers
  • Implement DLP (Data Loss Prevention) rules on outbound corporate networks to block patterns matching PEM headers

Remediation Steps:

  1. Identify all running n8n container or host instances and check active versions
  2. Apply the software update to upgrade n8n to version 1.123.64, 2.29.8, or 2.30.1 or higher
  3. Access the Google Cloud IAM & Admin Console and locate the service accounts used by the n8n workflows
  4. Delete and revoke the compromised private keys in the GCP console
  5. Generate new JSON credentials on GCP and upload them into the patched n8n application
  6. Conduct log queries across application and network logs for signatures containing standard PEM key fragments inside JWT headers

References

Read the full report for CVE-2026-65599 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)