CVE-2026-59209

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4	Product Release Notes
https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1	Product Release Notes
https://github.com/n8n-io/n8n/security/advisories/GHSA-q3j5-8vrg-4p9q	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:n8n:n8n:::::community:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:::::community:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:2.28.0::::community:node.js::*
	cpe:2.3:a:n8n:n8n:2.28.0::::enterprise:node.js::*

History

No history.

Information

Published : 2026-07-09 17:17

Updated : 2026-07-13 15:28

NVD link : CVE-2026-59209

Mitre link : CVE-2026-59209

CVE.ORG link : CVE-2026-59209

JSON object : View

Products Affected

n8n

n8n

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-59209", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59209", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T17:28:13.567036Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": ">= 2.28.0, < 2.28.1"}, {"status": "affected", "version": ">= 2.0.0-rc.0, < 2.27.4"}, {"status": "affected", "version": "< 1.123.61"}]}]}], "published": "2026-07-09T17:17:01.780", "references": [{"url": "https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-q3j5-8vrg-4p9q", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1."}], "lastModified": "2026-07-13T15:28:25.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "D00BFA14-A523-4D78-9A1A-5641AB85239C", "versionEndExcluding": "1.123.61"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "69CA6B10-34F7-456F-B65C-D7FDE633E1D9", "versionEndExcluding": "1.123.61"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "83675722-0ECC-4643-AD7B-E6C60D5883F0", "versionEndExcluding": "2.27.4", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "EDCB534B-2F81-4365-BBBB-7038C0545A33", "versionEndExcluding": "2.27.4", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.28.0:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BB35EC07-71EC-4987-9CDA-C905B6B55C24"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.28.0:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "7F36D9A7-91A7-4113-84C3-D46037611150"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}