CVE-2026-59259: n8n - Permission Bypass via Expression Parser Mismatch in External Secrets
Impact Due to a mismatch between the static validation check and the runtime expression engine, an authenticated user with credential create or update permissions, but without the externalSecret:list scope, could embed external secret references into credentials in forms the validation did not detect. These references would resolve at workflow execution time, exposing secret values the user was not authorized to access.
This issue only affects instances where an external secrets provider is configured and Advanced Permissions are in use.
Patches The issue has been fixed in n8n versions 1.123.61, 2.27.4, and 2.28.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict credential creation and update permissions to fully trusted users only. - Audit existing credentials for unexpected external secret references.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Other sources
n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine. An authenticated user with credential create or update permissions but without the externalSecret:list scope can embed external secret references into credentials in forms the static validation does not detect; these references resolve at workflow execution time, exposing secret values the user is not authorized to access. This issue only affects instances where an external secrets provider is configured and Advanced Permissions are in use.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.27.4 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 2.28.1 - Upgrade
Upgrade
npm/n8nto a version that resolves this vulnerability.Fixed in 1.123.61 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 1.123.61 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.27.4 - Upgrade
Upgrade
n8nto a version that resolves this vulnerability.Fixed in 2.28.1 - Compensating control
Restrict credential creation and update permissions to fully trusted users only (to mitigate users embedding external secret references via expression parser mismatch).
- Operational
Audit existing credentials for unexpected external secret references that may resolve at workflow execution time and expose secret values the creator/updater was not authorized to access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-59259?
CVE-2026-59259 has a medium severity rating with a CVSS score of 6.
How do I fix CVE-2026-59259?
To mitigate CVE-2026-59259, upgrade n8n to versions 1.123.61, 2.27.4, or 2.28.1 or later.
What type of vulnerability is CVE-2026-59259?
CVE-2026-59259 is a permission bypass vulnerability linked to external secrets handling.
Who is affected by CVE-2026-59259?
Users of n8n prior to versions 1.123.61, 2.27.4, and 2.28.1 are at risk from CVE-2026-59259.
What causes CVE-2026-59259?
CVE-2026-59259 is caused by a mismatch between the static validation check and the runtime expression engine.