CVE-2026-59254: n8n Information Disclosure Vulnerability

CVE-2026-59254 Overview

CVE-2026-59254 is an information disclosure vulnerability in n8n workflow automation platform versions before 2.28.1. The flaw allows authenticated project editors to read plaintext external secret values by referencing them in workflow node expressions. The vulnerability bypasses the credentials scope boundary that normally restricts secrets access to authorized users. External secrets are incorrectly resolved outside their intended permission model [CWE-639: Authorization Bypass Through User-Controlled Key]. Attackers with project editor access can extract sensitive credentials without holding explicit secrets access permissions.

Critical Impact
Authenticated project editors can exfiltrate plaintext external secrets, exposing API keys, database credentials, and third-party service tokens managed through n8n's external secrets integration.

Affected Products

n8n versions prior to 2.28.1
n8n deployments using external secrets integrations
Self-hosted and cloud n8n instances with multi-user project access

Discovery Timeline

2026-07-15 - CVE-2026-59254 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-59254

Vulnerability Analysis

n8n is a workflow automation platform that integrates external secrets managers such as HashiCorp Vault, AWS Secrets Manager, and Azure Key Vault. External secrets are designed to be referenced only within the credentials configuration scope, where role-based access controls gate their use.

The vulnerability arises because the expression resolver evaluates external secret references in any node expression context, not only within credentials. A project editor can craft a workflow node containing an expression that references an external secret. When the workflow executes or the expression is evaluated in the editor, the platform returns the plaintext secret value.

This breaks the authorization boundary between workflow authoring permissions and secrets access permissions. The role separation model assumes that only users with secrets access can retrieve plaintext values, but the expression engine does not enforce that check.

Root Cause

The root cause is missing authorization enforcement in the workflow expression resolution logic. The resolver processes external secret references without validating that the requesting user holds the required secrets access permission. This maps to CWE-639, where an authorization decision relies on a key or reference that a lower-privileged user can supply.

Attack Vector

Exploitation requires an authenticated account with project editor privileges on any project that has external secrets configured. The attacker adds a node expression that dereferences a target external secret, then triggers evaluation through workflow execution, testing, or the expression preview interface. The plaintext secret is returned in the node output or preview response, which the attacker can capture from the UI or the underlying API. See the GitHub Security Advisory GHSA-2434 and the VulnCheck Advisory on n8n Vulnerability for additional technical detail.

Detection Methods for CVE-2026-59254

Indicators of Compromise

Workflow node expressions containing references to $secrets or external secrets provider syntax created by users who lack explicit secrets access permissions.
Unexpected workflow executions authored by project editor accounts that reference external secret paths.
Audit log entries showing expression evaluation or test executions on nodes containing secret references outside credential fields.

Detection Strategies

Review n8n audit logs for workflow.update and workflow.execute events where the payload includes external secret reference patterns in non-credential node parameters.
Compare the set of users authoring secret references against the roster of accounts granted secrets access; any mismatch is suspect.
Inspect workflow JSON exports for expressions of the form {{ $secrets.provider.key }} embedded in node parameter fields rather than credential fields.

Monitoring Recommendations

Enable and forward n8n audit logs to a centralized log platform for continuous review.
Alert on workflow definitions containing external secret expressions created or modified by non-privileged accounts.
Track outbound API calls originating from workflow executions that could exfiltrate resolved secret values to attacker-controlled endpoints.

How to Mitigate CVE-2026-59254

Immediate Actions Required

Upgrade n8n to version 2.28.1 or later on all self-hosted and managed instances.
Rotate all external secrets that were accessible to any project editor while vulnerable versions were running.
Audit project editor role assignments and remove access for accounts that do not require workflow authoring privileges.

Patch Information

The vendor addressed the issue in n8n 2.28.1, which enforces the secrets access permission check during expression resolution regardless of where the reference appears. Refer to the GitHub Security Advisory GHSA-2434 for release notes and upgrade guidance.

Workarounds

Restrict project editor role assignments to trusted users until the patch is applied.
Temporarily disable external secrets integrations in projects that grant editor access to lower-trust users.
Migrate high-value secrets to standard credential storage with strict role scoping until the environment is upgraded.

bash

# Verify installed n8n version and upgrade
n8n --version
npm install -g n8n@2.28.1

# Docker deployments
docker pull n8nio/n8n:2.28.1
docker stop n8n && docker rm n8n
docker run -d --name n8n -p 5678:5678 n8nio/n8n:2.28.1