Executive brief
n8n is a workflow automation platform that manages credentials and integrates with external secret vaults. An authenticated user without proper permissions could retrieve plaintext values of secrets from connected vaults by referencing them during credential creation, bypassing permission checks. This allows unauthorized access to sensitive data stored in vault integrations without requiring admin privileges.
Technical details
This is a privilege escalation vulnerability (CWE-863) in n8n's external secrets handling. An authenticated user lacking the externalSecret:list permission can bypass authorization checks by referencing an external secret by name when saving a credential, allowing retrieval of its plaintext value. The vulnerability requires the instance to have an external secrets vault configured and the attacker to know or guess the target secret name. The attack is network-accessible, requires low privileges (any authenticated user), and has high confidentiality impact. Patches are available in n8n versions 1.123.23 (for 1.x branch) and 2.6.4 (for 2.x branch).
Affected products
- n8n n8n before 1.123.23 and 2.0.0-rc.0 before 2.6.4
Timeline
- 2026-03-25: disclosed