GHSA-fxcw-h3qj-8m8p: n8n Has External Secrets Authorization Bypass in Credential Saving

Summary

n8n has an authorization bypass in credential saving that affects instances with an external secrets vault configured. An authenticated user lacking the externalSecret:list permission can reference a secret by its external name in a credential and retrieve the plaintext value on save, bypassing that check. The attacker must know or guess the target secret's name.

Mitigation

The issue has been fixed in n8n versions 1.123.23 and 2.6.4. Upgrade to one of these versions or later. If upgrading is not immediately possible, restrict n8n access to fully trusted users only and disable the external secrets integration until the patch can be applied. These workarounds do not fully remediate the risk and should only be used as short-term measures.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• n8nnpmLLM dependency since 2026-02-10

Related items

• MediumRecent AI agent experiments reveal a risky future of machine 'teamwork' inside corporationsSimilar attack · CNBC Technology
• MediumClaude Code's “Don't Ask Again” File Exposes Passwords and Keys in 1,122 Public Copies on GitHubSimilar attack · The Hacker News
• MediumCVE-2026-118046: JS Help Desk plugin stored DOM-based cross-site scripting via jsticket_messageSimilar attack · NVD/CVE Database
• MediumARTEX abuse expands as cybercriminals target financial sectorSimilar attack · Microsoft Security Blog
• MediumCVE-2026-102610: fast-agent serve unauthenticated remote command execution via /mcp endpointSimilar attack · NVD/CVE Database