CVE-2026-59254

What it actually does

Authenticated project editors can resolve and retrieve plaintext values of external secrets by referencing them in workflow node expressions even when the expression is outside any credentials scope.

Why it matters to the business

Organizations may suffer unauthorized exposure of stored secrets such as API keys or database credentials, increasing risk of data breaches or downstream system compromise.

How an attack unfolds

An attacker with project-editor privileges creates or edits a workflow, inserts an expression that references an external secret outside the credentials context, executes the node, and observes the resolved secret value in the node output or logs.

How to fix it

Upgrade n8n to version 2.28.1 or later; review and restrict project-editor permissions; audit existing workflows for expression-based secret references.

How to confirm the fix worked

Confirm the installed version is 2.28.1 or newer; attempt to reference an external secret from a non-credential expression as a project editor and verify the value is no longer disclosed.

Typical attack path

1. Obtain or compromise an account with project-editor permissions
2. Open or create a workflow in the affected project
3. Add a node that supports expressions and craft a reference to an external secret
4. Execute the workflow or node to trigger secret resolution
5. Capture the plaintext secret from node result, logs, or exported data

How to detect it

Review workflow execution logs and node output history for expressions that resolve external secrets; monitor for unexpected access to secret stores from non-credential contexts.

What your security team should do

• Immediately upgrade all n8n instances to 2.28.1 or later
• Limit project-editor role to trusted users only
• Scan existing workflows for expressions that reference external secrets outside credentials
• Rotate any secrets that may have been exposed prior to the upgrade