CVE-2026-33722: n8n Workflow Automation Auth Bypass Flaw

CVE-2026-33722 Overview

CVE-2026-33722 is an authorization bypass vulnerability in n8n, the open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This vulnerability bypasses the externalSecret:list permission check and allows unauthorized access to secrets stored in connected vaults without requiring admin or owner privileges.

Critical Impact

Authenticated users can bypass permission controls to access sensitive secrets from external vaults, potentially exposing credentials, API keys, and other confidential data stored in connected secret management systems.

Affected Products

• n8n versions prior to 2.6.4
• n8n versions prior to 1.123.23
• n8n instances with external secrets vault integration configured

Discovery Timeline

• 2026-03-25 - CVE CVE-2026-33722 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-33722

Vulnerability Analysis

This vulnerability falls under CWE-863 (Incorrect Authorization), where the application fails to properly enforce access control restrictions on the external secrets functionality. When an authenticated user attempts to save a credential containing a reference to an external secret, the application retrieves the secret's plaintext value without adequately verifying whether the user possesses the required externalSecret:list permission.

The authorization bypass occurs during the credential save operation rather than the secret listing operation. While the system correctly prevents unauthorized users from viewing the list of available external secrets through normal channels, it fails to apply the same permission check when a secret is referenced by name within a credential definition. This creates an indirect access path that circumvents the intended permission model.

The exploitation requires the attacker to have an authenticated session on the n8n instance, meaning they must be a legitimate user of the platform. Additionally, the attacker needs to know or successfully guess the name of a target secret stored in the connected vault. This constraint limits opportunistic exploitation but does not prevent targeted attacks by malicious insiders or users who have obtained secret names through other means.

Root Cause

The root cause is improper authorization enforcement in the credential save handler. The application correctly implements permission checks for direct secret listing operations but fails to apply equivalent authorization validation when secrets are indirectly accessed through credential references. This inconsistent application of access controls creates a privilege escalation vector where the credential save functionality effectively grants elevated access to external secrets data.

Attack Vector

The attack leverages the network-accessible n8n interface (as indicated by the network attack vector). An authenticated attacker with low-level privileges can craft a credential definition that references an external secret by its known or guessed name. When the attacker saves this credential, the application processes the secret reference and returns the plaintext value, bypassing the externalSecret:list permission requirement.

The attack requires the following conditions:

• The n8n instance must have an external secrets vault configured
• The attacker must have valid authentication credentials for the n8n instance
• The attacker must know or be able to guess the name of a target secret

Once these conditions are met, the attacker can systematically extract secrets from the connected vault by creating credentials that reference different secret names.

Detection Methods for CVE-2026-33722

Indicators of Compromise

• Unusual credential creation or modification activity from users without externalSecret:list permissions
• Multiple failed or successful credential saves containing external secret references from non-privileged accounts
• Audit log entries showing credential operations that reference secrets the user should not have access to
• Unexpected access patterns to credential save endpoints

Detection Strategies

• Monitor n8n application logs for credential save operations by users who lack external secrets permissions
• Implement audit logging for all external secret reference resolutions, tracking which users trigger secret retrieval
• Create alerts for credential modifications that include external secret syntax patterns from non-admin users
• Deploy application-layer monitoring to detect anomalous credential save request volumes

Monitoring Recommendations

• Enable comprehensive audit logging for the n8n application, particularly for credential and secrets-related operations
• Establish baseline metrics for credential save operations per user to identify anomalous behavior
• Monitor for reconnaissance activity such as repeated credential save attempts with varying secret name guesses
• Correlate authentication events with credential operations to identify potential abuse patterns

How to Mitigate CVE-2026-33722

Immediate Actions Required

• Upgrade n8n to version 2.6.4 or 1.123.23 or later immediately
• Audit recent credential creation and modification activities for potential exploitation indicators
• Review user access permissions and remove unnecessary n8n access for untrusted users
• Verify the principle of least privilege is applied to all n8n user accounts

Patch Information

The vulnerability has been addressed in n8n versions 1.123.23 and 2.6.4. Users should upgrade to one of these versions or later to fully remediate the vulnerability. Additional technical details are available in the GitHub Security Advisory.

Workarounds

• Restrict n8n access to fully trusted users only until the patch can be applied
• Disable external secrets integration temporarily if not critical to operations
• Implement network-level access controls to limit who can reach the n8n instance
• Consider rotating secrets stored in connected vaults if exploitation is suspected

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures until upgrading is possible.

# Verify n8n version after upgrade
n8n --version
# Expected output: 2.6.4 or 1.123.23 or higher