← Back

CVE-2026-65589

nvd nist
Published: Jul 22, 2026Modified: Jul 27, 2026

JSON object

Loading...
5.1
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Show more
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XShow less
Source: disclosure@vulncheck.com (Secondary)

Description

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.

Affected (6)

Products: N8n: N8n
N8n
1 product
N8n
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
N8n
N8n
Before 1.123.64
N8n
From 2.0.0 to 2.29.8
N8n
Before 1.123.64
N8n
From 2.0.0 to 2.29.8
N8n
Version 2.30.0
N8n
Version 2.30.0

Related CWEs

CWE-532
Insertion of Sensitive Information into Log File
Information written to log files can be of a sensitive nature and give valuable guidance to an attacker or expose sensitive user information.

References (2)

Source: disclosure@vulncheck.com
MitigationVendor Advisory
Source: disclosure@vulncheck.com
Third Party Advisory

Timeline

No history available yet.