Every CVE Search/ Get API key

CVE-2026-59254

n8n - External Secrets Disclosure via Workflow Node Expressions

6.3 MediumFix available

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
None

Exploit likelihood

0.36%Up 0.1 points since Jul 16, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

n8n - External Secrets Disclosure via Workflow Node Expressions

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

Record
CVE-2026-59254
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-639
Updated
2026-11-02
EUVDEUVD-2026-44634 6.3

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

Record
EUVD-2026-44634
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-2434-3x6q-8r99 6.3

n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

Impact

External secrets were incorrectly resolved in workflow node expressions, where they are not intended to be available. An authenticated user with project editor access could read the plaintext value of external secrets by referencing them in a node expression, without needing explicit secrets access permissions.

This issue only affects instances with the external secrets feature configured.

Patches

The issue has been fixed in n8n versions 2.27.4 and 2.28.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Restrict project membership to fully trusted users only.
  • Avoid granting editor access to projects on instances where external secrets are configured.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Record
GHSA-2434-3x6q-8r99
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-639
Updated
2026-11-02
GitHub AdvisoriesGHSA-3j7v-fhjg-6rh2 6.3

Duplicate Advisory: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-2434-3x6q-8r99. This link is maintained to preserve external references.

Original Description

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

Record
GHSA-3j7v-fhjg-6rh2
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-639
Updated
2026-11-02
NVD 6.3

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

Record
CVE-2026-59254
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-639
Updated
2026-11-02
OSV 6.3

n8n - External Secrets Disclosure via Workflow Node Expressions

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

Record
CVE-2026-59254
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-639
Updated
2026-11-02
OSVGHSA-2434-3x6q-8r99 6.3

n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

Impact

External secrets were incorrectly resolved in workflow node expressions, where they are not intended to be available. An authenticated user with project editor access could read the plaintext value of external secrets by referencing them in a node expression, without needing explicit secrets access permissions.

This issue only affects instances with the external secrets feature configured.

Patches

The issue has been fixed in n8n versions 2.27.4 and 2.28.1. Users should upgrade to one of these versions or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Restrict project membership to fully trusted users only.
  • Avoid granting editor access to projects on instances where external secrets are configured.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Record
GHSA-2434-3x6q-8r99
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Weakness
CWE-639
Updated
2026-11-02
OSVGHSA-3j7v-fhjg-6rh2 6.3

Duplicate Advisory: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-2434-3x6q-8r99. This link is maintained to preserve external references.

Original Description

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

Record
GHSA-3j7v-fhjg-6rh2
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-639
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
n8n
npm
 2.28.0 up to 2.28.1
2.28.1
n8n
npm
 before 2.27.4
2.27.4

History

History
RecordedChangedSources
affected
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-59254 is a medium vulnerability (CVSS 6.3) in N8n, published July 15, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.36%, the 30th percentile. Fixed in n8n 2.28.1.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open