CVE-2026-59254CWE-639

n8n - External Secrets Disclosure via Workflow Node Expressions

Medium · published July 15, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
29.1
In the wild
Unconfirmed
What it is

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS
0.00364 · 29.1th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-07-15T11:25Z
EPSS history
Timeline
  • 15 JUL 11:25Z
    n8n - External Secrets Disclosure via Workflow Node Expressions
    cvelistv5