Redbot Labs / Threat Intelligence
n8n Inline Agent Vulnerability Allows Members to Expose Other Projects’ Credentials
- Incident ID
- RBT-TI-0096
- Organization
- n8n
- Reported Location
- Berlin, Germany - Vendor Location; No Confirmed Victim Location Disclosed
- Severity
- High
- Category
- AI Agent Infrastructure / Credential Exposure / Broken Access Control
- Record Date
- 2026-09-16
Incident Summary
Cross-project credential exposure. n8n disclosed an inline-agent vulnerability allowing an ordinary member to expose credentials belonging to other projects, including the instance owner.
Pre-model failure. The authorization gap occurred during tool preparation, before the language model was consulted.
What Happened
Missing ownership validation. Tool input-schema resolution decrypted and used a referenced credential without checking project ownership. The corresponding execution path did contain an ownership check.
Externally directed disclosure. A member could reference a credential ID and cause its plaintext secret to reach a destination they controlled.
Patch available. n8n corrected the issue in versions 2.39.6 and 2.40.1. The vendor assigned a High severity rating of 8.3. Technical findings and remediation
Affected Systems
n8n Inline Agents / Tool Input-Schema Resolution / Stored Integration Credentials
Attack Vector
Authenticated Member Access / Missing Credential Ownership Check / Credential Exfiltration
Business Impact
Expanded access risk. Exposed secrets could jeopardize connected services, depending on their permissions.
Evidence limits. The advisory establishes a vulnerability, without naming breached customers or reporting confirmed financial losses. Vendor impact assessment
Redbot Analysis
Agent preparation belongs inside the security boundary. Redbot Labs assesses that tool discovery, configuration, and schema generation require the same authorization scrutiny as final tool execution. Preparatory operations can have security consequences when they access protected resources.
Enforce ownership before accessing secrets. Applications should validate the requesting identity and project permissions before decrypting or using a stored credential. A resource identifier should never serve as proof of authorization.
Test isolation with low-privilege accounts. Validation should include attempts to reference resources owned by other projects, administrators, and service accounts across every stage of an agent workflow.
Constrain downstream impact. Integration credentials should carry only the permissions necessary for their purpose. Where exposure is suspected, incident response should assess credential use in connected systems and rotate affected secrets.
