CVE-2026-59259
Received Received - Intake

External Secrets Permission Bypass in n8n

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: VulnCheck

Description
n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create or update permissions but without the externalSecret:list scope can embed external secret references into credentials in forms the static validation does not detect; these references resolve at workflow execution time, exposing secret values the user is not authorized to access. This issue only affects instances where an external secrets provider is configured and Advanced Permissions are in use.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-15
Last Modified
2026-07-15
Generated
2026-07-15
AI Q&A
2026-07-15
EPSS Evaluated
N/A
NVD
CVE-2026-59259
EUVD
EUVD-2026-44635

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
n8n n8n to 1.123.61|end_excluding=2.27.4|end_excluding=2.28.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-639 The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a permission bypass in n8n workflow automation tool versions before 1.123.61, 2.27.4, and 2.28.1. It occurs due to a mismatch between static validation checks and the runtime expression engine. An authenticated user with credential permissions but without the externalSecret:list scope can embed external secret references into credentials that bypass static checks. These references resolve during workflow execution, exposing secret values the user is not authorized to access.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive secret values they are not permitted to view. If an external secrets provider is configured and Advanced Permissions are enabled, attackers with limited access could exploit this to steal credentials, API keys, or other confidential data during workflow execution.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected n8n versions may face regulatory penalties due to potential data breaches and loss of confidentiality.

Detection Guidance

To detect this vulnerability, audit n8n instances for unauthorized external secret references in credentials. Check workflow execution logs for unexpected secret exposures. Review user permissions to ensure only authorized users have credential create/update rights without externalSecret:list scope. Use n8n's admin panel to inspect credentials for embedded expressions referencing external secrets.

Mitigation Strategies

Immediately upgrade n8n to versions 1.123.61, 2.27.4, or 2.28.1 or later. Restrict credential creation/update permissions to trusted users only. Audit existing credentials for unauthorized external secret references and remove them. Disable Advanced Permissions if external secrets are not required. Monitor workflow execution logs for suspicious secret exposures.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-59259. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart