Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: n8n, n8n 2.27.4, 2.28.1 Clear all filters
TI-2026-42399 CVE-2026-59259 · GHSA-jp7m-xcgx-57qm

n8n - Permission Bypass via Expression Parser Mismatch in External Secrets

Priority LOW 27

n8n before versions 1.123.61, 2.27.4, and 2.28.1 contains a permission bypass vulnerability in external secrets handling caused by a mismatch between the static validation check and the runtime expression engine.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00438 Published 2026-07-15 Fixed in 1.123.61, 2.28.1 +1 CWE-639
TI-2026-42394 CVE-2026-59254 · GHSA-2434-3x6q-8r99

n8n - External Secrets Disclosure via Workflow Node Expressions

Priority LOW 28

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00364 Published 2026-07-15 Fixed in 2.28.1, 2.27.4 CWE-639