Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| n8n | npm | < 1.123.64 | 1.123.64 |
| n8n | npm | >= 2.30.0, < 2.30.1 | 2.30.1 |
| n8n | npm | >= 2.0.0-rc.0, < 2.29.8 | 2.29.8 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in the incorrect creation of a JSON Web Token (JWT) for Google Service Account authentication. The full PEM private key was being placed in the kid field of the JWT header, which is only base64 encoded and not encrypted, thus exposing the key. The fix was to use the x5t header with the SHA-1 thumbprint of the certificate to identify the key, which is the correct and secure method. The commit 283eb7d11b97b174c4a41804220871524b0c6626 introduces a new function buildClientAssertion that correctly constructs the JWT. The functions ClientOAuth2Token.refresh, CodeFlow.getToken, and CredentialsFlow.getToken were all modified to use this new function when the client credential type is 'certificate', thus patching the vulnerability. These functions are the primary indicators of the vulnerable flow in a runtime profile.
