Cloudanix VulnDB

CVE-2026-59259

Medium · 6.5

CVSS

6.5

EPSS

0.4%

Published

Jul 15, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

Some users could secretly access protected external credentials they were not allowed to see by hiding references inside other settings.

Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Data Exposure
Component
Application
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Authenticated users with credential create or update permissions can embed external secret references that bypass static validation checks, allowing resolution at workflow runtime to expose secret values without the externalSecret:list scope.

Why it matters to the business

Organizations using external secrets providers with advanced permissions face unauthorized exposure of sensitive credentials, increasing risk of data leaks and compliance violations until upgrades are applied.

How an attack unfolds

An attacker with limited credential permissions creates or updates a credential containing specially crafted external secret references undetected by static checks; at workflow execution the runtime engine resolves the references, retrieving and exposing unauthorized secret values from the configured provider.

How to fix it

Upgrade n8n to version 1.123.61 or later, 2.27.4 or later, or 2.28.1 or later; disable external secrets or advanced permissions if immediate upgrade is not possible.

How to confirm the fix worked

Verify the installed n8n version is at or above 1.123.61, 2.27.4, or 2.28.1; confirm external secret references are now rejected during credential creation or update when the required scope is absent.

Typical attack path

  1. Obtain authenticated access with credential create or update rights but lacking externalSecret:list scope
  2. Craft and submit a credential containing external secret references that evade static validation
  3. Trigger workflow execution to force runtime resolution of the references
  4. Capture the resolved secret values returned during execution

How to detect it

Review workflow execution logs and credential audit trails for unexpected external secret resolutions by users lacking the externalSecret:list scope; inspect credential definitions for embedded references that bypass static checks.

What your security team should do

  • Apply the listed version upgrades immediately on all instances using external secrets
  • Audit existing credentials for unauthorized external secret references
  • Review and tighten advanced permission assignments around credential and secret scopes
  • Monitor workflow execution logs for unexpected secret resolutions

The record

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create or update permissions but without the externalSecret:list scope can embed external secret references into credentials in forms the static validation does not detect; these references resolve at workflow execution time, exposing secret values the user is not authorized to access. This issue only affects instances where an external secrets provider is configured and Advanced Permissions are in use.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities