Google Service Account Private Key Exposed in JWT Header

What it is

GHSA-9r8p-h6cc-6qhm is an n8n advisory. With a Google Service Account credential, n8n built its signed JWT with the entire PEM private key in the header's kid field, where only a key identifier belongs. The advisory rates it Moderate, CVSS v4 5.1.

How it works

JWT headers are Base64-encoded, not encrypted. Anything that records or inspects the token can decode the header and recover the key. The advisory names proxy, load balancer and application logs as places this can happen. With the key, an attacker can impersonate the service account and read or modify any Google Cloud resource that account is authorized for.

Preconditions / Affected

• Only instances using Google Service Account credentials are affected.
• Exposure depends on the JWT header having been logged or inspected somewhere. The key does not leak without that.
• The CVSS vector reads Network / Low complexity / Attack Requirements Present / Privileges Required High / no user interaction. Impact on n8n itself is Low confidentiality. Impact on the subsequent system (Google Cloud) is High confidentiality, Low integrity and Low availability. The Moderate score understates the downstream risk: the blast radius is whatever the service account can do in GCP, not what n8n can do.

What to do

1. Upgrade to 1.123.64, 2.29.8, 2.30.1 or later.
2. Rotate every Google Service Account key that may have been used with an affected n8n version. Upgrading alone does not invalidate keys already exposed.
3. Search proxy, load balancer and application logs for JWT headers containing key material. Treat any key found there as compromised.
4. If you cannot upgrade yet, avoid Google Service Account credentials until the instance is patched.

The advisory gives no log-search query or pattern. Decoding the Base64 header segment and checking kid for PEM content is one way to check, but that is my suggestion, not the page's.

Caveats

The advisory says the workarounds do not fully remediate the risk and are short-term only. It does not say whether exploitation has been seen in the wild, and it gives no CVE id.