A significant security flaw has been discovered in n8n, a popular workflow automation tool, that could allow unauthorized access to sensitive information. This vulnerability, tracked as CVE-2026-59259, is related to how n8n handles external secrets, posing a risk to data confidentiality.
This issue arises from a difference between n8n’s static validation checks and its runtime expression engine. Essentially, an authenticated user who has permissions to create or update credentials, but lacks the specific authority to list external secrets (externalSecret:list scope), could craft credentials in a way that bypasses the initial security checks. When these specially crafted credentials are used during workflow execution, they would reveal secret values that the user was not supposed to see.
It’s important to note that this vulnerability primarily affects n8n installations that have an external secrets provider configured and are actively using Advanced Permissions. If your n8n setup uses these features, it’s crucial to pay close attention to this advisory.
CVE Details
- Product: n8n
- Published: July 15, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The permission bypass vulnerability affects several versions of n8n. Specifically, any installations running versions before 1.123.61, 2.27.4, and 2.28.1 are vulnerable. If you are using any n8n version prior to these, your system could be at risk.
Current Status
The vulnerability (CVE-2026-59259) has been fully analyzed. This means security researchers have thoroughly investigated the flaw, understood its nature, and provided details on its impact and potential solutions.
Severity Level
This vulnerability is rated as Medium severity with a CVSS score of 6.5. A medium severity rating indicates that while an exploit might not be trivial, it could lead to significant unauthorized access to sensitive information, in this case, external secret values. The CVSS score further emphasizes the potential impact, highlighting the need for prompt action to mitigate the risk.
Possible Solutions
Fortunately, n8n has already released patches to address this vulnerability. The most effective solution is to update your n8n instance to a patched version immediately.
- Upgrade: Update your n8n installation to version 1.123.61, 2.27.4, 2.28.1, or any newer version. These versions contain the necessary fixes to close the permission bypass loophole.
Temporary Workarounds:
If immediate upgrading is not feasible, consider implementing the following temporary mitigation steps:
- Restrict Permissions: Limit the ability to create and update credentials to only highly trusted users within your organization. This reduces the attack surface by ensuring fewer users have the necessary baseline permissions to exploit the flaw.
- Audit Credentials: Regularly review existing credentials for any unexpected or suspicious external secret references. This can help identify if the vulnerability has already been exploited or if any malicious configurations exist.
Please remember that these workarounds are temporary and do not provide a complete fix. Upgrading to a patched version remains the recommended and most secure solution.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-jp7m-xcgx-57qm
https://www.vulncheck.com/advisories/n8n-permission-bypass-via-expression-parser-mismatch-in-external-secrets
