CVE-2026-65589 describes a vulnerability in n8n prior to version 1.123.64 where custom HTTP header credentials used in LLM sub-node executions are not properly masked. As a result, plaintext API keys and secrets are recorded in workflow execution logs stored in the database. Authenticated users who can access execution data may retrieve and export these sensitive credentials, leading to potential credential exposure. The vulnerability has a CVSS 4.0 score of 5.1, indicating a medium severity level. No official patch or remediation level has been provided in the available data, and no known exploits are reported in the wild.

Sensitive credentials such as API keys and secrets may be exposed in plaintext within workflow execution logs. This exposure allows any authenticated user with access to execution data to read and export these credentials, potentially leading to unauthorized access to external services or systems that rely on these keys. The vulnerability does not appear to allow privilege escalation or remote code execution but compromises confidentiality of sensitive information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to execution data strictly to trusted users and consider auditing or purging sensitive logs containing credentials. Avoid using highly privileged API keys in workflows that may be logged. Monitor vendor communications for updates regarding patches or official mitigations.