CVE-2026-59209: n8n Credential Exposure via Pagination Expression – Patch & Detection Guide

Technical summary

CVE-2026-59209 is an information disclosure vulnerability in n8n's HTTP Request node. The flaw exists in how credential-populated headers are exposed through the $request object during pagination expression evaluation. An authenticated member with use-only editor access to a shared workflow can access this $request context, read sensitive header values (typically containing credentials or API keys), and exfiltrate them by manipulating pagination expressions to return credential data as part of the workflow's item output. The vulnerability is rooted in insufficient access controls on sensitive runtime objects and improper data isolation between credential scope and expression evaluation context (CWE-200: Exposure of Sensitive Information to an Unauthorized Actor; CWE-522: Insufficiently Protected Credentials).

Business impact

This vulnerability creates a privilege escalation and data theft risk within n8n deployments. Users with minimal workflow permissions—those intended only to execute pre-built automations—can gain unauthorized access to credentials that may control integrations with critical business systems, third-party APIs, cloud services, or databases. Compromised credentials can enable lateral movement, unauthorized data access, or malicious workflow modifications. Organizations using n8n to orchestrate sensitive integrations face exposure of authentication tokens, API keys, and other secrets managed within the platform.

Affected systems

The vulnerability impacts n8n versions prior to 1.123.61 (v1 line), 2.27.4 (v2 line), and 2.28.1 (v2 line). Organizations running open-source n8n instances with shared workflows and multiple users assigned editor roles are at risk. Cloud-hosted n8n accounts and self-hosted deployments are both affected. The issue only manifests when use-only editors have access to HTTP Request nodes with pagination expressions that reference the $request object.

Exploitability

Exploitation requires authentication and existing access to a shared workflow—this is not an unauthenticated remote attack. However, the barrier to exploitation is low once an attacker or insider with editor access is present. No complex technical steps are required; pagination expressions are a standard feature and reading the $request object is intuitive for anyone familiar with n8n's expression language. The attack leaves audit trails through workflow execution logs, but exfiltrated credentials can be used immediately. The CVSS 3.1 score of 6.5 (MEDIUM) reflects the requirement for authentication and local access, balanced against the high confidentiality impact.

Remediation

Upgrade to n8n versions 1.123.61, 2.27.4, or 2.28.1 or later. These versions restrict access to credential-populated headers in pagination expression contexts, ensuring that use-only editors cannot read sensitive data from the $request object. After patching, verify that your workflows continue to function correctly, as expressions depending on request metadata may need adjustment. Review access control assignments on shared workflows to ensure principle of least privilege: assign use-only access only to users who genuinely need only to execute workflows, not modify them.

Patch guidance

Apply updates immediately across all n8n instances. If you operate multiple n8n environments, prioritize production and shared-workflow instances first. Patch testing in a non-production instance is recommended to confirm workflow compatibility. The vendor has released fixes across multiple release tracks (v1 and v2), so identify which version line(s) your deployment uses and pull the appropriate patched release. Verify successful deployment by checking version information in the n8n UI and confirming that workflow execution logs show the updated version.

Detection guidance

Monitor workflow execution logs for use-only editors accessing HTTP Request nodes with pagination expressions. Look for unusual patterns: pagination expressions containing $request references, or the same user executing workflows multiple times in rapid succession. If possible, review audit logs for credential exfiltration indicators—specifically, cases where workflow item outputs contain header values or API keys. Examine shared workflows to identify which users have editor access and whether that access level is justified. Network monitoring can detect outbound exfiltration of stolen credentials if they are used in unauthorized API calls post-compromise.

Why prioritize this

While the CVSS score is MEDIUM, the practical risk depends on your n8n deployment model and user base. Organizations with shared workflows and multiple users should prioritize this patch highly, as insider threat or compromised user accounts can immediately yield high-value secrets. Single-user or isolated n8n instances face lower risk. The credential exposure potential and the likelihood that extracted keys could grant access to downstream systems warrant moving this into your patch window promptly, especially if your n8n instance orchestrates integrations with sensitive business systems.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects: (1) Network-accessible attack surface (AV:N); (2) Low complexity, no special conditions required (AC:L); (3) Authentication required, but only baseline user access (PR:L); (4) User interaction not required (UI:N); (5) No impact on system availability or integrity (I:N, A:N); (6) High confidentiality impact—direct exposure of stored credentials (C:H). The MEDIUM severity is appropriate for a credential disclosure within a multi-user system; the practical impact is context-dependent and could be higher if your workflows control critical integrations.

Frequently asked questions