Quick answers
- Is CVE-2026-59209 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59209 being exploited in the wild.
- How severe is CVE-2026-59209?
- High severity, with a CVSS score of 4, published 9 July 2026.
- Which products and versions are affected?
- N8n < 1.123.61, >= 2.0.0-rc.0 < 2.27.4, >= 2.28.0 < 2.28.1; n8n (npm) SEMVER:introduced=0,fixed=1.123.61.
- Is there a fix for CVE-2026-59209?
- Yes. n8n (npm): upgrade to 1.123.61 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59209 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-59209?
- Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- n8n (npm): upgrade to 1.123.61 or later
npm install n8n@1.123.61
Technical details
An information disclosure vulnerability exists in n8n when the N8N_EXPRESSION_ENGINE is set to 'vm'. Authenticated users with 'use-only' editor access to a shared workflow can exploit the HTTP Request node's pagination feature to read sensitive headers. Specifically, the '$request' object exposes credential-populated headers during pagination expression evaluation. An attacker can craft a custom expression to copy these secrets into item data and exfiltrate them via subsequent nodes, bypassing domain restrictions. The issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
Affected products
- n8n-io n8n < 1.123.61, >= 2.0.0-rc.0 < 2.27.4, >= 2.28.0 < 2.28.1
Identifiers
- CVE-2026-59209
- GHSA-q3j5-8vrg-4p9q
Timeline
- 2026-06-24: disclosed
- 2026-07-09: advisory: NVD publication
- 2026-07-22: patched: GitHub Advisory reviewed and updated