n8n: Credential-Using Nodes Forward Authentication Headers on Cross-Origin Redirects

Impact

When an HTTP request made by a credential-authenticated node followed a redirect to a different origin, n8n re-attached the Authorization header and basic auth credentials to the redirected request. The internal helper that builds the redirect configuration defaulted sendCredentialsOnCrossOriginRedirect to true. The HTTP Request node v4.4 opted out of this default, but other credential-using nodes did not. Where a workflow makes authenticated HTTP requests and the redirect target can be influenced by untrusted data, such as an expression-fed URL or a redirect issued by an attacker-controlled endpoint, the stored credential could be forwarded to an unintended destination.

Patches

The issue has been fixed in n8n versions 2.46.1, 2.45.5 and v3.0.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

• Restrict n8n instance access to fully trusted users only.
• Audit active workflows that use credential-authenticated HTTP requests and ensure that request URLs and any data that could influence redirect targets do not incorporate untrusted external input.
• Apply network-level controls to restrict outbound HTTP requests from the n8n process to known, trusted destinations.
• Enable SSRF protection by setting N8N_SSRF_PROTECTION_ENABLED=true to reduce the risk of attacker-influenced outbound requests.
• Rotate any credentials used by workflows that may have been exposed to untrusted redirect targets.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.