CVE-2026-59259: n8n permission bypass in external secrets handling

Executive brief

n8n is a workflow automation tool used to connect different software services. A security flaw allowed users with limited permissions to bypass access controls and view sensitive external secrets (like API keys or passwords) they were not authorized to see. This could lead to unauthorized access to third-party services integrated with the n8n platform.

Technical details

A vulnerability exists in n8n due to a mismatch between the static validation check and the runtime expression engine. Authenticated users with permissions to create or update credentials, but lacking the 'externalSecret:list' scope, could embed external secret references into credentials using formats that bypassed validation. These references would then resolve during workflow execution, exposing unauthorized secret values. The issue specifically affects instances using Advanced Permissions and an external secrets provider. Patches are available in versions 1.123.61, 2.27.4, and 2.28.1.

Affected products

• n8n-io n8n < 1.123.61, >= 2.0.0-rc.0, < 2.27.4, >= 2.28.0, < 2.28.1

Timeline

• 2026-06-24: disclosed
• 2026-07-22: advisory

References

• https://api.github.com/users/YLChen-007
• https://github.com/YLChen-007
• https://api.github.com/users/YLChen-007/gists%7B/gist_id%7D
• https://api.github.com/users/YLChen-007/repos
• https://avatars.githubusercontent.com/u/30854794?v=4
• https://api.github.com/users/YLChen-007/events%7B/privacy%7D