CVE-2026-59209 | BDVDB-2026-346649 Detail

Description#

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-07-09Record published in the CVE List.