Tr4Ce-Ju

**Name of the Vulnerable Software and Affected Versions** n8n versions prior to 1.123.27 n8n versions prior to 2.13.3 n8n versions prior to 2.14.1 **Description** An authenticated user with the `global:member` role could exploit authorization flaws in n8n's credential pipeline to obtain plaintext secrets from generic HTTP credentials (`httpBasicAuth`, `httpHeaderAuth`, `httpQueryAuth`) belonging to other users on the same instance. The attack exploits a name-based credential resolution path that lacks ownership or project scope enforcement, combined with a bypass in the credentials permission checker that skips validation for generic HTTP credential types. This allows a user with the `global:member` role to resolve another user's credential ID and execute a workflow that decrypts and uses that credential without authorization. Native integration credential types (e.g., `slackApi`, `openAiApi`, `postgres`) are not affected. This issue impacts only the Community Edition of n8n. **Recommendations** Upgrade to n8n version 1.123.27 or later. Upgrade to n8n version 2.13.3 or later. Upgrade to n8n version 2.14.1 or later. If upgrading is not immediately possible, restrict instance access to fully trusted users only. If upgrading is not immediately possible, audit credentials stored on the instance and rotate any generic HTTP credentials (`httpBasicAuth`, `httpHeaderAuth`, `httpQueryAuth`) that may have been exposed.

**Name of the Vulnerable Software and Affected Versions** BlackSheep versions prior to 2.4.6 **Description** BlackSheep, an asynchronous web framework for building event-based web applications with Python, has an issue in its HTTP Client implementation. Missing validation of headers allows an attacker to modify HTTP requests, potentially inserting new headers or creating entirely new requests. Exploitation requires passing unsanitized user input directly into headers. The server component is not affected as BlackSheep relies on an underlying ASGI server for handling response headers. The attack vector involves applications using user input in HTTP client requests related to the method, URL, or headers. **Recommendations** Upgrade to version 2.4.6. If handling headers from untrusted sources, reject values for header names and values that contain carriage returns.