CVE-2026-59254
n8n - External Secrets Disclosure via Workflow Node Expressions
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.
| CWE | CWE-639 |
| Vendor | n8n |
| Product | n8n |
| Published | Jul 15, 2026 |
| Last Updated | Jul 15, 2026 |
Stay Ahead of the Next One
Get instant alerts for n8n n8n
Be the first to know when new unknown vulnerabilities affecting n8n n8n are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
n8n / n8n
0 < 2.28.1
n8n / n8n
0 < 2.27.4