CVE-2026-59254
Vulnerability Description
n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.
Vulnerability Details
Published Date
Last Modified
CWE ID
CWE-639
Source
NVD
Vendor
n8n
Product
n8n
Discussion (0)
Add Comment
No comments yet. Be the first!