{"data":{"id":"c45ab9e4-3849-4f85-b2c5-7a633e718524","title":"GHSA-2434-3x6q-8r99: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials","summary":"GHSA-2434-3x6q-8r99 affects n8n instances with the external secrets feature configured. An authenticated user with project editor access can read the plaintext value of external secrets by referencing them in a workflow node expression, without needing explicit secrets access permissions.","solution":"Fixed in n8n versions 2.27.4 and 2.28.1; upgrade to one of these versions or later. If upgrading is not immediately possible, restrict project membership to fully trusted users only and avoid granting editor access to projects on instances where external secrets are configured. These workarounds do not fully remediate the risk and are short-term measures only.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-2434-3x6q-8r99","publishedAt":"2026-07-22T22:23:29.000Z","cveId":"CVE-2026-59254","cweIds":null,"cvssScore":null,"cvssSeverity":"medium","severity":"medium","attackType":[],"issueType":"vulnerability","affectedPackages":["n8n@< 2.27.4 (fixed: 2.27.4)","n8n@>= 2.28.0, < 2.28.1 (fixed: 2.28.1)"],"affectedPackageNames":["n8n"],"affectedPackageRefs":["npm:n8n"],"affectedVendors":[],"affectedVendorsRaw":["n8n"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":"unknown","epssScore":0.00364,"epssCheckedAt":"2026-11-13T12:06:18.233Z","kevDateAdded":null,"advisoryAliases":["GHSA-2434-3x6q-8r99"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-07-22T22:23:29.000Z","fixReleasedAt":"2026-06-24T10:31:36.527Z","daysToFix":-28,"fixCheckedAt":"2026-10-29T21:32:47.307Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.6,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"n8n","fixedVersion":"2.27.4","matchedVersion":"2.27.4","fixReleasedAt":"2026-06-24T10:42:03.277Z","daysToFix":-28,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:47.161Z"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.28.1","matchedVersion":"2.28.1","fixReleasedAt":"2026-06-24T10:31:36.527Z","daysToFix":-28,"match":"ecosystem","source":"tracked","status":"found","checkedAt":"2026-10-29T21:32:47.161Z"}]}}