n8n is a powerful open-source platform designed to help you automate various workflows. It simplifies complex tasks by allowing users to connect different services and build custom automations. However, a recent security discovery highlights an important vulnerability that all n8n users should be aware of.
A flaw has been identified where an authenticated user, even with limited “use-only editor” access to a shared workflow, could potentially read and steal sensitive credential-populated headers. This exposure occurs within the $request object of an HTTP Request node’s pagination expression. In simpler terms, a user with specific, but not full, access rights could trick the system into revealing secret information that should remain hidden.
CVE Details
- Product: n8n workflow automation platform
- Published: July 9, 2026
- Severity: Medium (CVSS Score 6.5)
- Status: Analyzed
Affected Products
This vulnerability impacts various versions of n8n, including both community and enterprise editions. Specifically, any n8n installation running a version older than 1.123.61, 2.27.4, or 2.28.1 is at risk.
Current Status
The vulnerability has been thoroughly analyzed by the n8n team. Thankfully, fixes have been developed and released to address this issue. The status of this vulnerability is “Analyzed,” meaning it has been investigated, understood, and solutions are available.
Severity Level
The Common Vulnerability Scoring System (CVSS) rates this vulnerability with a score of 6.5, categorizing it as “Medium” severity. While it requires an authenticated user with at least “use-only editor” access to a shared workflow, the ability to extract credentials is a significant concern. Unauthorized access to credentials can lead to further system compromise, data breaches, or impersonation, making timely patching crucial.
Possible Solutions
The good news is that n8n has already released patches to fix this vulnerability. To protect your n8n installations and sensitive data, it is strongly recommended that you upgrade your platform to one of the patched versions:
- n8n version 1.123.61
- n8n version 2.27.4
- n8n version 2.28.1
Or any subsequent versions that include these fixes. Always ensure your software is up-to-date to benefit from the latest security enhancements.
References
- https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4
- https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1
- https://github.com/n8n-io/n8n/security/advisories/GHSA-q3j5-8vrg-4p9q
