CVE-2026-65589 describes a vulnerability in n8n versions prior to 1.123.64 where custom HTTP header credentials used in LLM sub-node executions are not properly masked. As a result, plaintext API keys and secrets are recorded in workflow execution logs and stored in the database. Authenticated users with permission to view execution data can access these sensitive values, which may also be included in exported data. This improper handling of sensitive information constitutes an information disclosure vulnerability with a CVSS 4.0 base score of 5.1 (medium severity). No vendor advisory or patch information is currently provided.

Sensitive credentials such as API keys and secrets are exposed in plaintext within execution logs and database records. Authenticated users with access to execution data can read these credentials, increasing the risk of credential compromise and unauthorized access to integrated services. The vulnerability does not allow unauthenticated access or privilege escalation but poses a confidentiality risk to sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to execution data strictly to trusted users and avoid exporting execution data containing sensitive headers. Review and rotate any exposed API keys or secrets to limit potential misuse.