CVE-2026-65589: n8n: Custom Header Credential Values Leaked in Plaintext into LLM Node Execution Data

In the credential editor, custom header values for these LLM sub-nodes look hidden. During a workflow run, though, n8n records the headers in the execution data as plain text (CWE-532, sensitive information in logs). The header names and values are visible to any authenticated user who has access to the execution data of an affected workflow.

Those values are typically API keys or other secrets for the LLM provider or a gateway in front of it. Execution data can be saved to the database and exported, so the secrets can outlive the single run and spread to backups and exports.

The attacker needs a low-privileged account with access to the workflow's executions. No user interaction is needed. The CVSS 4.0 vector rates confidentiality impact as low on n8n itself but high on subsequent systems, which fits a leaked provider key. Only workflows that use LLM sub-nodes with custom headers defined in their credentials are affected.

Affected: n8n below 1.123.64 on the 1.x line, 2.0.0-rc.0 up to but not including 2.29.8, and 2.30.0. Only workflows using LLM sub-nodes (the advisory names OpenAI, Anthropic and Lemonade) with custom headers in their credentials leak.

Check the version:

npm ls n8n

Then review your LLM credentials for custom headers.

Upgrade to n8n 1.123.64, 2.29.8 or 2.30.1, or later. For an npm install, run npm install [email protected].

Temporary mitigations from the advisory, none of which fully remove the risk:

• Restrict access to execution data to fully trusted users.
• Avoid custom headers in LLM node credentials, and use another authentication method where you can.
• Rotate any API keys or secrets that were stored as custom header values.

Upgrading does not remove values already saved in past execution data, so rotate the secrets and consider pruning old executions.

Open past executions of workflows with LLM sub-nodes and look for header names and values in the node's data. Search stored execution data and any exports or backups for your header names. Check the LLM provider's usage logs for your key being used from unfamiliar addresses. List which users can open executions for those workflows, since each of them could have read the values.

Impact

Custom HTTP headers configured in credentials for certain LLM sub-nodes (including OpenAI, Anthropic, and Lemonade) are masked in the n8n UI but are written in plaintext into execution data during workflow runs. Any authenticated user with access to the execution data for an affected workflow can read the header names and values, which typically contain API keys or other secrets.

Because execution data can be persisted to the database and exported, leaked values may remain accessible beyond the lifetime of a single execution.

This issue only affects instances where workflows use LLM sub-nodes with custom headers defined in their credentials.

Patches

The issue has been fixed in n8n versions 1.123.64, 2.29.8, and 2.30.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict access to execution data to fully trusted users only.
• Avoid configuring custom headers in LLM node credentials; use alternative authentication mechanisms where possible.
• Rotate any API keys or secrets that may have been stored as custom header values in affected credentials.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.