CVE-2026-59209

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4	Product Release Notes
https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1	Product Release Notes
https://github.com/n8n-io/n8n/security/advisories/GHSA-q3j5-8vrg-4p9q	Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:n8n:n8n:::::community:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:::::community:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:2.28.0::::community:node.js::*
	cpe:2.3:a:n8n:n8n:2.28.0::::enterprise:node.js::*

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) n8n es una plataforma de automatización de flujos de trabajo de código abierto. Antes de las versiones 1.123.61, 2.27.4 y 2.28.1, un miembro autenticado con acceso de editor de solo uso a un flujo de trabajo compartido podría leer encabezados poblados con credenciales expuestos a través del objeto $request dentro de la expresión de paginación de un nodo de Solicitud HTTP y exfiltrar el secreto a través de los datos del elemento. Este problema está solucionado en las versiones 1.123.61, 2.27.4 y 2.28.1.

Information

Published : 2026-07-09 17:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-59209

Mitre link : CVE-2026-59209

CVE.ORG link : CVE-2026-59209

JSON object : View

Products Affected

n8n

n8n

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

CWE-522

Insufficiently Protected Credentials

{"id": "CVE-2026-59209", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-59209", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T17:28:13.567036Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": ">= 2.28.0, < 2.28.1"}, {"status": "affected", "version": ">= 2.0.0-rc.0, < 2.27.4"}, {"status": "affected", "version": "< 1.123.61"}]}]}], "published": "2026-07-09T17:17:01.780", "references": [{"url": "https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-q3j5-8vrg-4p9q", "tags": ["Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}, {"lang": "en", "value": "CWE-522"}]}], "descriptions": [{"lang": "en", "value": "n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1."}, {"lang": "es", "value": "n8n es una plataforma de automatizaci\u00f3n de flujos de trabajo de c\u00f3digo abierto. Antes de las versiones 1.123.61, 2.27.4 y 2.28.1, un miembro autenticado con acceso de editor de solo uso a un flujo de trabajo compartido podr\u00eda leer encabezados poblados con credenciales expuestos a trav\u00e9s del objeto $request dentro de la expresi\u00f3n de paginaci\u00f3n de un nodo de Solicitud HTTP y exfiltrar el secreto a trav\u00e9s de los datos del elemento. Este problema est\u00e1 solucionado en las versiones 1.123.61, 2.27.4 y 2.28.1."}], "lastModified": "2026-10-25T17:10:00.197", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "D00BFA14-A523-4D78-9A1A-5641AB85239C", "versionEndExcluding": "1.123.61"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "69CA6B10-34F7-456F-B65C-D7FDE633E1D9", "versionEndExcluding": "1.123.61"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "83675722-0ECC-4643-AD7B-E6C60D5883F0", "versionEndExcluding": "2.27.4", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "EDCB534B-2F81-4365-BBBB-7038C0545A33", "versionEndExcluding": "2.27.4", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.28.0:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "BB35EC07-71EC-4987-9CDA-C905B6B55C24"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.28.0:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "7F36D9A7-91A7-4113-84C3-D46037611150"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}