Skip to content
← Vulnerability catalog
OFFICIAL CVE RECORD6.3 Medium

CVE-2026-59254

n8n - External Secrets Disclosure via Workflow Node Expressions

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

n8n n8n

Default version status: unaffected

  • 2.28.0 to < 2.28.1affected
  • 2.28.1unaffected
pkg:npm/n8n

n8n n8n

Default version status: unaffected

  • 0 to < 2.27.4affected
  • 2.27.4unaffected
pkg:npm/n8n

References