n8n: External Secrets Permission Bypass via Expression Parser Mismatch (CVE-2026-59259)
A vulnerability in n8n allows an authenticated user with credential create or update permissions, but without the externalSecret:list scope, to bypass permission checks due to a mismatch between static validation and runtime expression parsing. This can lead to unauthorized exposure of secret values at workflow execution time. The issue affects instances using an external secrets provider with Advanced Permissions enabled. Fixed versions are 1.123.61, 2.27.4, and 2.28.1 or later.
AI Analysis
Technical Summary
CVE-2026-59259 is a permission bypass vulnerability in n8n caused by a mismatch between the static validation check and the runtime expression engine. Authenticated users who have permission to create or update credentials but lack the externalSecret:list scope can embed external secret references into credentials in a way that static validation does not detect. These references resolve during workflow execution, exposing secret values that the user is not authorized to access. This vulnerability only affects n8n instances configured with an external secrets provider and using Advanced Permissions. The issue has been fixed in versions 1.123.61, 2.27.4, and 2.28.1.
Potential Impact
An attacker with limited permissions (credential create/update but no externalSecret:list scope) can gain unauthorized access to secret values by embedding external secret references that bypass static validation and resolve at runtime. This leads to exposure of sensitive secrets that should be restricted, potentially compromising confidentiality within affected n8n workflows.
Mitigation Recommendations
A fix is available in n8n versions 1.123.61, 2.27.4, and 2.28.1 and later. Users should upgrade to one of these versions to remediate the vulnerability. If immediate upgrade is not possible, administrators should restrict credential creation and update permissions to fully trusted users and audit existing credentials for unexpected external secret references. These workarounds do not fully mitigate the risk and should be considered temporary.
n8n: External Secrets Permission Bypass via Expression Parser Mismatch (CVE-2026-59259)
Description
A vulnerability in n8n allows an authenticated user with credential create or update permissions, but without the externalSecret:list scope, to bypass permission checks due to a mismatch between static validation and runtime expression parsing. This can lead to unauthorized exposure of secret values at workflow execution time. The issue affects instances using an external secrets provider with Advanced Permissions enabled. Fixed versions are 1.123.61, 2.27.4, and 2.28.1 or later.
CVSS v4.0
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-59259 is a permission bypass vulnerability in n8n caused by a mismatch between the static validation check and the runtime expression engine. Authenticated users who have permission to create or update credentials but lack the externalSecret:list scope can embed external secret references into credentials in a way that static validation does not detect. These references resolve during workflow execution, exposing secret values that the user is not authorized to access. This vulnerability only affects n8n instances configured with an external secrets provider and using Advanced Permissions. The issue has been fixed in versions 1.123.61, 2.27.4, and 2.28.1.
Potential Impact
An attacker with limited permissions (credential create/update but no externalSecret:list scope) can gain unauthorized access to secret values by embedding external secret references that bypass static validation and resolve at runtime. This leads to exposure of sensitive secrets that should be restricted, potentially compromising confidentiality within affected n8n workflows.
Mitigation Recommendations
A fix is available in n8n versions 1.123.61, 2.27.4, and 2.28.1 and later. Users should upgrade to one of these versions to remediate the vulnerability. If immediate upgrade is not possible, administrators should restrict credential creation and update permissions to fully trusted users and audit existing credentials for unexpected external secret references. These workarounds do not fully mitigate the risk and should be considered temporary.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-jp7m-xcgx-57qm
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-59259"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- MODERATE
- Cvss Version
- 4.0
Threat ID: 6a6150ca9c2644c7f8da00ae
Added to database: 07/22/2026, 23:22:50 UTC
Last enriched: 07/22/2026, 23:26:21 UTC
Last updated: 07/23/2026, 02:51:54 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.