n8n before 1.123.64, 2.29.8, and 2.30.1 is vulnerable when configured with a Google Service Account key. The application mistakenly places the full PEM private key in the JWT header’s kid field. Because JWT headers are only base64‑encoded, any component that logs or inspects the JWT can recover the private key. An attacker who obtains the key can impersonate the service account, then read, write, or delete any Google Cloud resource the account is authorized to use.

n8n (n8n‑io) versions earlier than 1.123.64, 2.29.8, and 2.30.1 that use Google Service Account credentials.

The CVSS score of 5.1 indicates a moderate impact. The EPSS score is less than 1%, indicating a very low exploitation probability, and the flaw is not listed in CISA KEV. The vulnerability is exploitable by obtaining logged or intercepted JWT tokens, which may occur in local or remote scenarios depending on log exposure. If an attacker logs the JWT header, they can recover the private key and thereby elevate privileges within Google Cloud resources.