GHSA-2434-3x6q-8r99: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials
- Identifiers
- CVE-2026-59254GHSA-2434-3x6q-8r99
- Published
- Record updated
- Affected
- n8n < 2.27.4, fixed in 2.27.4, released June 24, 2026, 28 days before disclosure
- n8n >= 2.28.0, < 2.28.1, fixed in 2.28.1, released June 24, 2026, 28 days before disclosure
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.4%
Summary
GHSA-2434-3x6q-8r99 affects n8n instances with the external secrets feature configured. An authenticated user with project editor access can read the plaintext value of external secrets by referencing them in a workflow node expression, without needing explicit secrets access permissions.
Mitigation
Fixed in n8n versions 2.27.4 and 2.28.1; upgrade to one of these versions or later. If upgrading is not immediately possible, restrict project membership to fully trusted users only and avoid granting editor access to projects on instances where external secrets are configured. These workarounds do not fully remediate the risk and are short-term measures only.
Affected packages in the Exposure Registry
Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.
- n8nnpmLLM dependency since 2026-02-10