CVE-2026-65589
Received
Received - Intake
n8n LLM Sub-Node Credential Exposure via Unmasked HTTP Headers
Vulnerability report for CVE-2026-65589, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-07-22
Last updated on: 2026-07-22
Assigner: VulnCheck
Description
Description
n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| n8n | n8n | to 1.123.64 (exc) |
| n8n | n8n | 1.123.64 |
| n8n | n8n | 2.29.8 |
| n8n | n8n | 2.30.1 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-532 | The product writes sensitive information to a log file. |
