# CVE-2026-65589: n8n credential exposure in LLM sub-node execution data

Source: https://junglewise.ai/threats/cve-2026-65589-n8n-credential-exposure-in-llm-sub-node-execution-data  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-22. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-65589 · Severity: medium · CVSS 4 · Published 2026-07-22

n8n is a workflow automation tool used to connect different software services. A security issue was found where sensitive information, such as API keys for AI services like OpenAI and Anthropic, is saved in plain text within the system's execution logs. Any logged-in user with access to these logs can see these secrets, potentially allowing them to hijack connected AI accounts or access private data.

Technologies: [N8n](https://junglewise.ai/threats/technologies/n8n), [n8n (npm)](https://junglewise.ai/threats/technologies/npm-n8n). Vendors: [N8n](https://junglewise.ai/threats/vendors/n8n), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-65589 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-65589 being exploited in the wild.

**How severe is CVE-2026-65589?** Medium severity, with a CVSS score of 4, published 22 July 2026.

**Which products and versions are affected?** N8n < 1.123.64, < 2.29.8, < 2.30.1, < 1.123.64, >= 2.0.0-rc.0 < 2.29.8, >= 2.30.0 < 2.30.1; n8n (npm) SEMVER:introduced=0,fixed=1.123.64.

**Is there a fix for CVE-2026-65589?** Yes. n8n (npm): upgrade to 1.123.64 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-65589 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-65589?** Check whether you run N8n or n8n (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- n8n (npm): upgrade to 1.123.64 or later

  ```sh
  npm install n8n@1.123.64
  ```


## Technical details

A sensitive information disclosure vulnerability (CWE-532) exists in n8n's LLM sub-nodes, including those for OpenAI, Anthropic, and Lemonade. While custom HTTP headers are masked in the user interface, the underlying application writes these values in plaintext into the execution data stored in the database. An authenticated attacker with low privileges who has access to workflow execution records can retrieve these secrets. The vulnerability is particularly impactful because execution data is often persisted long-term and can be exported. The issue is resolved in versions 1.123.64, 2.29.8, and 2.30.1.

## Affected products

- n8n-io n8n < 1.123.64, >= 2.0.0-rc.0 < 2.29.8, >= 2.30.0 < 2.30.1

## Identifiers

- CVE-2026-65589
- GHSA-89gh-3pgc-v5h2

## Timeline

- 2026-07-08: disclosed: Initial disclosure by Jubke
- 2026-07-22: advisory: GitHub Advisory published

## References

- [https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2](https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2)
- [https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64](https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64)
- [https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8](https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8)
- [https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1](https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1)
- [https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-node-execution-data](https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-node-execution-data)

## Related threats

- [n8n path traversal in Databricks node](https://junglewise.ai/threats/cve-2026-119557-n8n-from-2-14-0-through-2-46-3-contains-a-path-traversal)
- [n8n remote code execution in deprecated Function nodes](https://junglewise.ai/threats/cve-2026-119408-n8n-before-2-42-6-2-43-x-before-2-43-3-and-3-x-before-3-0-1)
- [n8n Slack Trigger SSRF and token exfiltration](https://junglewise.ai/threats/cve-2026-118679-n8n-before-1-123-83-2-41-4-and-2-42-1-contains-a-server-side)
- [n8n prototype pollution in workflow history compaction](https://junglewise.ai/threats/cve-2026-118678-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-prototype)
- [n8n Local Gateway deep-link missing confirmation re-pairing](https://junglewise.ai/threats/cve-2026-118677-n8n-before-2-41-4-and-2-42-x-before-2-42-1-contains-a-missing)