CVE-2026-59209
Full vulnerability record from the local CVENow database.
Description
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
Severity
HIGH
CVSS score
7.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-09 17:17:01.780000
Last modified
2026-10-25 17:10:00.197000
View original CVE JSON
{
"id": "CVE-2026-59209",
"sourceIdentifier": "[email protected]",
"published": "2026-07-09T17:17:01.780",
"lastModified": "2026-10-25T17:10:00.197",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1."
},
{
"lang": "es",
"value": "n8n es una plataforma de automatización de flujos de trabajo de código abierto. Antes de las versiones 1.123.61, 2.27.4 y 2.28.1, un miembro autenticado con acceso de editor de solo uso a un flujo de trabajo compartido podría leer encabezados poblados con credenciales expuestos a través del objeto $request dentro de la expresión de paginación de un nodo de Solicitud HTTP y exfiltrar el secreto a través de los datos del elemento. Este problema está solucionado en las versiones 1.123.61, 2.27.4 y 2.28.1."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n8n-io",
"product": "n8n",
"versions": [
{
"version": ">= 2.28.0, < 2.28.1",
"status": "affected"
},
{
"version": ">= 2.0.0-rc.0, < 2.27.4",
"status": "affected"
},
{
"version": "< 1.123.61",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-09T17:28:13.567036Z",
"id": "CVE-2026-59209",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-200"
},
{
"lang": "en",
"value": "CWE-522"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*",
"versionEndExcluding": "1.123.61",
"matchCriteriaId": "D00BFA14-A523-4D78-9A1A-5641AB85239C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*",
"versionEndExcluding": "1.123.61",
"matchCriteriaId": "69CA6B10-34F7-456F-B65C-D7FDE633E1D9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.27.4",
"matchCriteriaId": "83675722-0ECC-4643-AD7B-E6C60D5883F0"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.27.4",
"matchCriteriaId": "EDCB534B-2F81-4365-BBBB-7038C0545A33"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:2.28.0:*:*:*:community:node.js:*:*",
"matchCriteriaId": "BB35EC07-71EC-4987-9CDA-C905B6B55C24"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:2.28.0:*:*:*:enterprise:node.js:*:*",
"matchCriteriaId": "7F36D9A7-91A7-4113-84C3-D46037611150"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1",
"source": "[email protected]",
"tags": [
"Product",
"Release Notes"
]
},
{
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-q3j5-8vrg-4p9q",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
}
]
}