CVE-2026-65589
Full vulnerability record from the local CVENow database.
Description
n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.
Severity
MEDIUM
CVSS score
5.1
(v4.0)
Vulnerability status
Analyzed
Source identifier
Published
2026-07-22 12:18:18.857000
Last modified
2026-10-29 19:17:25.990000
View original CVE JSON
{
"id": "CVE-2026-65589",
"sourceIdentifier": "[email protected]",
"published": "2026-07-22T12:18:18.857",
"lastModified": "2026-10-29T19:17:25.990",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported."
},
{
"lang": "es",
"value": "Las versiones de n8n anteriores a la 1.123.64 fallan al enmascarar correctamente las credenciales de encabezado HTTP personalizadas en los datos de ejecución de subnodos LLM, escribiendo claves API y secretos en texto plano en los registros de ejecución de flujos de trabajo. Los usuarios autenticados con acceso a los datos de ejecución pueden leer los valores de encabezado y las credenciales expuestos que persisten en la base de datos y pueden ser exportados."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "n8n-io",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "0",
"lessThan": "1.123.64",
"versionType": "semver",
"status": "affected"
},
{
"version": "1.123.64",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "n8n-io",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "2.30.0",
"lessThan": "2.30.1",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.30.1",
"versionType": "semver",
"status": "unaffected"
}
]
},
{
"vendor": "n8n-io",
"product": "n8n",
"defaultStatus": "unaffected",
"packageURL": "pkg:npm/n8n",
"versions": [
{
"version": "2.0.0-rc.0",
"lessThan": "2.29.8",
"versionType": "semver",
"status": "affected"
},
{
"version": "2.29.8",
"versionType": "semver",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV40": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "4.0",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"vulnConfidentialityImpact": "LOW",
"vulnIntegrityImpact": "NONE",
"vulnAvailabilityImpact": "NONE",
"subConfidentialityImpact": "HIGH",
"subIntegrityImpact": "LOW",
"subAvailabilityImpact": "NONE",
"exploitMaturity": "NOT_DEFINED",
"confidentialityRequirement": "NOT_DEFINED",
"integrityRequirement": "NOT_DEFINED",
"availabilityRequirement": "NOT_DEFINED",
"modifiedAttackVector": "NOT_DEFINED",
"modifiedAttackComplexity": "NOT_DEFINED",
"modifiedAttackRequirements": "NOT_DEFINED",
"modifiedPrivilegesRequired": "NOT_DEFINED",
"modifiedUserInteraction": "NOT_DEFINED",
"modifiedVulnConfidentialityImpact": "NOT_DEFINED",
"modifiedVulnIntegrityImpact": "NOT_DEFINED",
"modifiedVulnAvailabilityImpact": "NOT_DEFINED",
"modifiedSubConfidentialityImpact": "NOT_DEFINED",
"modifiedSubIntegrityImpact": "NOT_DEFINED",
"modifiedSubAvailabilityImpact": "NOT_DEFINED",
"Safety": "NOT_DEFINED",
"Automatable": "NOT_DEFINED",
"Recovery": "NOT_DEFINED",
"valueDensity": "NOT_DEFINED",
"vulnerabilityResponseEffort": "NOT_DEFINED",
"providerUrgency": "NOT_DEFINED"
}
}
],
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-07-23T13:52:00.547281Z",
"id": "CVE-2026-65589",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-532"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*",
"versionEndExcluding": "1.123.64",
"matchCriteriaId": "843094AD-81C8-4961-A8A1-037468DEACA7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*",
"versionEndExcluding": "1.123.64",
"matchCriteriaId": "E1626500-EC42-4BF5-8ECE-6E5E249D37F6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:community:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.29.8",
"matchCriteriaId": "3281592C-CB07-412C-9770-3521447ADEC1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:*:*:*:*:enterprise:node.js:*:*",
"versionStartIncluding": "2.0.0",
"versionEndExcluding": "2.29.8",
"matchCriteriaId": "E4A0C557-F57B-4931-A857-ACC4639C030D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:community:node.js:*:*",
"matchCriteriaId": "E125F7EF-F72F-427F-82DE-D6A505B1DF8F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:n8n:n8n:2.30.0:*:*:*:enterprise:node.js:*:*",
"matchCriteriaId": "3C2780A0-55EC-488D-9149-EE83BA246A38"
}
]
}
]
}
],
"references": [
{
"url": "https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2",
"source": "[email protected]",
"tags": [
"Mitigation",
"Vendor Advisory"
]
},
{
"url": "https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-node-execution-data",
"source": "[email protected]",
"tags": [
"Third Party Advisory"
]
}
]
}