CVE-2026-59209
n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
Vexday Risk Score
18Low
SSVC decision (CISA)
Track
No exploitation signal → monitor
CVSS 7.1EPSS —KEV nãoPoC —Nuclei —Metasploit —Patch —
Lifecycle
09 Jul 2026Published on NVD
Recommendation: Monitor — no exploitation signal at the moment.
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
n8n-io · n8n