AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-jp7m-xcgx-57qm: n8n: External Secrets Permission Bypass via Expression Parser Mismatch

mediumvulnerability

security

Source: GitHub Advisory DatabaseJuly 22, 2026CVE-2026-59259

Summary

n8n had a security flaw where the system that checks permissions (static validation) didn't match the system that runs code (runtime expression engine), allowing authenticated users to sneak external secret references into credentials they weren't supposed to access. This could expose secret values at workflow execution time to users who lacked the proper authorization, but only affects instances with an external secrets provider configured and Advanced Permissions enabled.

Solution / Mitigation

The issue has been fixed in n8n versions 1.123.61, 2.27.4, and 2.28.1. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should restrict credential creation and update permissions to fully trusted users only and audit existing credentials for unexpected external secret references, though these workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.