Information Disclosure in n8n Workflow Automation

Executive Summary

CVE-2026-59209 is a vulnerability in n8n, an open-source workflow automation platform. It allows an authenticated user with editor access to a shared workflow to read credential-populated headers that are exposed via the $request object inside an HTTP Request node's pagination expression.

Specifically, when an HTTP Header Auth credential is used in a paginated request, the secret credential is exposed in the $request.headers object during the evaluation of the pagination expression. An attacker can craft a user-controlled expression to access this secret, copy it into item data, and then exfiltrate it through a subsequent HTTP Request node.

This issue affects instances where the expression engine is set to VM mode and paginated HTTP Request workflows with shared credentials are accessible to non-owner users. The vulnerability has been fixed in n8n versions 1.123.61, 2.27.4, and 2.28.1.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to the unauthorized disclosure of sensitive credential information used in HTTP Header Auth within n8n workflows.

An attacker with editor access to a shared workflow could exfiltrate these secrets, potentially allowing them to access protected resources or services that rely on those credentials.

Because the attack requires only low complexity and no user interaction, it poses a significant confidentiality risk to affected systems.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by identifying if your n8n instance is running a vulnerable version prior to 1.123.61, 2.27.4, or 2.28.1 and if there are shared workflows with HTTP Request nodes using paginated requests that include credential-populated headers.

Specifically, detection involves checking for workflows where an authenticated user with editor access might have the ability to use pagination expressions that expose $request.headers containing sensitive credential information.

There are no explicit commands provided in the resources to detect this vulnerability on your system or network.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include upgrading n8n to a fixed version: 1.123.61, 2.27.4, or 2.28.1.

Until you can upgrade, restrict workflow sharing to trusted users only.

Avoid sharing credentials with untrusted users in workflows that use paginated HTTP Request nodes.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows an authenticated user with editor access to a shared workflow to exfiltrate credential-populated headers, which are sensitive secrets. Such unauthorized disclosure of credentials can lead to data breaches involving confidential information.

Because the vulnerability impacts confidentiality by exposing sensitive credentials, it could negatively affect compliance with data protection standards and regulations such as GDPR and HIPAA, which require safeguarding sensitive data and preventing unauthorized access or disclosure.

Mitigations include restricting workflow sharing to trusted users and avoiding sharing credentials with untrusted users in workflows using paginated HTTP Request nodes, which can help maintain compliance until patched versions are applied.

Useful 0 Not Useful 0