CVE-2026-65589

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2	Mitigation Vendor Advisory
https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-node-execution-data	Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:n8n:n8n:::::community:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:::::community:node.js::
	cpe:2.3:a:n8n:n8n:::::enterprise:node.js::
	cpe:2.3:a:n8n:n8n:2.30.0::::community:node.js::*
	cpe:2.3:a:n8n:n8n:2.30.0::::enterprise:node.js::*

History

No history.

Information

Published : 2026-07-22 12:18

Updated : 2026-07-27 19:09

NVD link : CVE-2026-65589

Mitre link : CVE-2026-65589

CVE.ORG link : CVE-2026-65589

JSON object : View

Products Affected

n8n

n8n

CWE

CWE-532

Insertion of Sensitive Information into Log File

{"id": "CVE-2026-65589", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-65589", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-23T13:52:00.547281Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "HIGH", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "0", "lessThan": "1.123.64", "versionType": "semver"}, {"status": "unaffected", "version": "1.123.64", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "0", "lessThan": "2.30.1", "versionType": "semver"}, {"status": "unaffected", "version": "2.30.1", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}, {"vendor": "n8n-io", "product": "n8n", "versions": [{"status": "affected", "version": "0", "lessThan": "2.29.8", "versionType": "semver"}, {"status": "unaffected", "version": "2.29.8", "versionType": "semver"}], "packageURL": "pkg:npm/n8n", "defaultStatus": "unaffected"}]}], "published": "2026-07-22T12:18:18.857", "references": [{"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2", "tags": ["Mitigation", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-node-execution-data", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-532"}]}], "descriptions": [{"lang": "en", "value": "n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported."}], "lastModified": "2026-07-27T19:09:14.453", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "843094AD-81C8-4961-A8A1-037468DEACA7", "versionEndExcluding": "1.123.64"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E1626500-EC42-4BF5-8ECE-6E5E249D37F6", "versionEndExcluding": "1.123.64"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3281592C-CB07-412C-9770-3521447ADEC1", "versionEndExcluding": "2.29.8", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E4A0C557-F57B-4931-A857-ACC4639C030D", "versionEndExcluding": "2.29.8", "versionStartIncluding": "2.0.0"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:community:node.js:*:*", "vulnerable": true, "matchCriteriaId": "E125F7EF-F72F-427F-82DE-D6A505B1DF8F"}, {"criteria": "cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:enterprise:node.js:*:*", "vulnerable": true, "matchCriteriaId": "3C2780A0-55EC-488D-9149-EE83BA246A38"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}