CVE-2026-59209: n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
Impact An authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression. When an HTTP Header Auth credential is applied to a paginated request, the secret is present in $request.headers when pagination expressions are evaluated. A user-controlled expression could read that secret, copy it into item data, and exfiltrate it through a later HTTP Request node, bypassing credential domain restrictions, since the secret leaves via item data rather than the credential's own request mechanism.
This issue only affects instances with N8NEXPRESSIONENGINE=vm set, where paginated HTTP Request workflows using shared credentials are accessible to non-owner users.
Patches The issue has been fixed in n8n versions 1.123.61, 2.27.4, and 2.28.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict workflow sharing to fully trusted users only. - Avoid sharing credentials with use-only access to untrusted users on workflows that use HTTP Request nodes with pagination enabled.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.27.4 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.28.1 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.61 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.61 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.27.4 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.28.1 - Configuration
Only applies when N8N_EXPRESSION_ENGINE=vm is set; mitigate by upgrading to n8n versions 1.123.61, 2.27.4, or 2.28.1 or later.
n8n N8N_EXPRESSION_ENGINE = vm - Compensating control
Restrict workflow sharing to fully trusted users only (an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data).
- Compensating control
Avoid sharing credentials with use-only access to untrusted users on workflows that use HTTP Request nodes with pagination enabled.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59209?
The severity of CVE-2026-59209 is rated at 55, indicating a moderate risk level.
What is CVE-2026-59209 about?
CVE-2026-59209 describes a credential header leak in n8n that allows authenticated editors to access sensitive information through a pagination expression.
How do I fix CVE-2026-59209?
To fix CVE-2026-59209, upgrade n8n to version 1.123.61, 2.27.4, or 2.28.1 or later.
Who is affected by CVE-2026-59209?
Users with authenticated member access and editor privileges to shared workflows in n8n prior to the fixed versions are affected by CVE-2026-59209.
What impact does CVE-2026-59209 have on n8n users?
CVE-2026-59209 can lead to exposure of sensitive credentials through leaked header information in HTTP requests.