Description

Detects when an n8n credential is shared with projects other than the one that owns it. Members who can edit workflows in any project it is shared with can use it in their own workflows and act on the connected service with all the access it holds, so the privileges of the credential reach users its owner does not manage, and a workflow in any of those projects can misuse them.

Detection Strategy

• Lists every credential of the instance through the n8n public API, which only an owner or admin API key can do, and reads the projects each one is shared with, never the credential's data

• Reports a vulnerability when the credential is shared with a project in any role other than owner; the project that owns it, and the members who reach the credential through that project, are not counted

• Records in the evidence the credential's name and type and, for each project, its ID and role, never a project's name; when the API key or the instance cannot list credentials, the rule is recorded as unreadable rather than reported as clean