T09 · Insecure Skill Coding Practices
- Location
workflows/content-gen-workflow.json:87- Finding
Blog Administrator API Key Transmitted over Plaintext HTTP
- Content
View full analysis
Vulnerability Details
File Location:
workflows/content-gen-workflow.json, lines 87–96
Vulnerability Type: Plaintext transmission of sensitive credentials
Risk Level: HighVulnerable Code
json "url": "http://YOUR_BLOG_ADMIN_HOST:3000/api/posts", "sendBody": true, "specifyBody": "json", "jsonBody": "={{ JSON.stringify({ slug: $json.slug, lang: 'en', frontmatter: {}, body: $json.content, raw: true }) }}", "sendHeaders": true, "headerParameters": { "parameters": [ { "name": "X-API-Key", "value": "={{ $env.NICHE_BLOG_ADMIN_API_KEY || 'YOUR_BLOG_ADMIN_API_KEY' }}" } ] }Technical Analysis
The publishing node sends a privileged blog API key in the
X-API-Keyrequest header to an endpoint configured with the unencryptedhttp://scheme. HTTP provides neither transport confidentiality nor server authenticity.An attacker with network visibility between the n8n instance and the blog administration service could capture the API key and complete generated article contents. An active network attacker could also modify the request in transit, redirect it, or replay it later.
The expression additionally falls back to the literal value
YOUR_BLOG_ADMIN_API_KEYwhen the environment variable is absent. Although this placeholder is not itself a secret, silently continuing with a fallback rather than failing closed can obscure configuration errors and generate unintended authentication attempts.Attack Path
- An operator replaces the host placeholder but retains the configured HTTP scheme and activates the workflow.
- On its scheduled execution, the workflow generates an article and submits it to the blog administration API.
- The request includes
NICHE_BLOG_ADMIN_API_KEYin theX-API-Keyheader and the unpublished article in its body. - An attacker positioned on the local network, an intermediate network segment, or another traffic-observation point captures or modifies the plaintext request.
- The at ...[truncated 792 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the plaintext endpoint with an
https://URL and require a valid TLS certificate. - Keep certificate verification enabled. Do not permit insecure TLS modes or acceptance of untrusted certificates in production.
- Add deployment-time validation that rejects endpoints using HTTP, unresolved placeholders, loopback mistakes, or unexpected hosts.
- Remove the literal API-key fallback and fail closed when the environment variable is missing, for example:
javascript ={{ (() => { if (!$env.NICHE_BLOG_ADMIN_API_KEY) { throw new Error('NICHE_BLOG_ADMIN_API_KEY is required'); } return $env.NICHE_BLOG_ADMIN_API_KEY; })() }}- Restrict the API key to the minimum necessary permissions, preferably create-only access to the required publishing endpoint.
- Apply destination allowlisting and network controls so the n8n instance can send publishing requests only to the intended blog service.
- Rotate the API key if the workflow has ever operated over an untrusted or plaintext network.
- Implement short-lived credentials, request signing, replay protection, and server-side audit logging where supported.
- Avoid logging authentication headers or full request objects in workflow execution logs.
- Replace the plaintext endpoint with an