Executive brief
n8n is a workflow automation tool used to connect various business applications and services. A security flaw in how the system handles external secrets allows authorized users to bypass permission restrictions and access sensitive credentials they should not be able to see. This could lead to the exposure of third-party service passwords or API keys, potentially allowing unauthorized actions in connected business platforms.
Technical details
A permission bypass exists in n8n's external secrets handling due to a logic mismatch between static validation and the runtime expression engine. Authenticated users with 'credential create/update' permissions, but lacking the 'externalSecret:list' scope, can craft specific external secret references that bypass static checks. These references are then resolved during workflow execution, allowing the user to retrieve secret values they are not authorized to access. The vulnerability specifically impacts instances using Advanced Permissions and a configured external secrets provider. Patches are available in versions 1.123.61, 2.27.4, and 2.28.1.
Affected products
- n8n-io n8n < 1.123.61, < 2.27.4, < 2.28.1
Timeline
- 2026-06-24: advisory: Original advisory GHSA-jp7m-xcgx-57qm published
- 2026-07-15: disclosed: CVE-2026-59259 published
- 2026-07-22: other: Duplicate advisory GHSA-q6mx-qvhp-fqmg withdrawn