CVE-2026-59209: n8n editor-level access leaks

Q: Is CVE-2026-59209 actively exploited?

No confirmed active exploitation of CVE-2026-59209 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-59209?

Upgrade n8n to 1.123.61, 2.27.4, or 2.28.1 immediately, where the $request object no longer exposes credential-populated headers to non-admin editors. Until patched, audit workflow sharing settings and revoke or downgrade "use-only" editor access for any user who does not need it on workflows containing credentialed HTTP Request nodes with pagination enabled. Rotate credentials referenced in any shared workflow accessible to non-admin collaborators, and review workflow execution logs/item data exports for evidence of header values appearing in run output as a detection signal for prior abuse.

Q: What systems are affected by CVE-2026-59209?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines.

Q: What is the CVSS score for CVE-2026-59209?

CVE-2026-59209 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.40%.

CISO Take

A flaw in n8n's HTTP Request node lets any workflow member with only "use" (non-admin) editor access read credential-populated HTTP headers by referencing the internal $request object inside a pagination expression, then exfiltrate the secret as ordinary item data returned by the node. This matters because n8n is widely used to orchestrate AI agents and API integrations, so the exposed headers are frequently live API keys for LLM providers, vector databases, or other downstream services rather than throwaway tokens — a single leaked key can cascade into billing abuse or a broader supply-chain foothold. There is no CVSS score, EPSS data, CISA KEV listing, public exploit, or Nuclei template for this issue yet, and exploitation requires an already-authenticated collaborator on a shared workflow, which caps the blast radius to insider/over-permissioned-access scenarios rather than opportunistic internet-wide attacks. Patch to n8n 1.123.61, 2.27.4, or 2.28.1 immediately, and in the interim audit who holds "use-only" editor access to workflows containing credentialed HTTP Request nodes and rotate any secrets used in pagination-enabled requests within shared workflows.

Sources: NVD GitHub Advisory ATLAS

What is the risk?

Low-to-moderate exploitability (requires pre-existing authenticated collaborator access to a shared workflow, not a remote/unauthenticated vector) combined with moderate-to-high impact (direct plaintext credential disclosure that can pivot into connected AI/API services). No CVSS vector, EPSS score, KEV listing, or public PoC/scanner exists, so opportunistic mass exploitation is unlikely; the realistic threat model is a malicious or compromised internal/contractor account abusing legitimate but over-scoped editor permissions — a classic insider/least-privilege failure rather than a novel AI attack technique.

How does the attack unfold?

Initial Access

Attacker obtains authenticated "use-only" editor access to a shared n8n workflow, e.g. as an insider, contractor, or compromised low-privilege account.

AML.T0012

Exploitation

Attacker edits the pagination expression on an HTTP Request node to reference the $request object, which exposes the fully-populated, credential-bearing request headers.

AML.T0055

Exfiltration

The credential value is captured into the node's item data output, which the attacker can view or export from the workflow execution.

AML.T0025

Impact

Attacker obtains a live API key or token for a connected AI/service integration, enabling billing abuse, data access, or lateral compromise of the downstream system.

Initial Access

Attacker obtains authenticated "use-only" editor access to a shared n8n workflow, e.g. as an insider, contractor, or compromised low-privilege account.

AML.T0012

Exploitation

Attacker edits the pagination expression on an HTTP Request node to reference the $request object, which exposes the fully-populated, credential-bearing request headers.

AML.T0055

Exfiltration

The credential value is captured into the node's item data output, which the attacker can view or export from the workflow execution.

AML.T0025

Impact

Attacker obtains a live API key or token for a connected AI/service integration, enabling billing abuse, data access, or lateral compromise of the downstream system.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.61	`1.123.61`
201.9K OpenSSF 6.7 Pushed 3d ago 51% patched ~6d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

6.5 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 33% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC Low

PR Low

UI None

S Unchanged

C High

I None

A None

What should I do?

1 step

Upgrade n8n to 1.123.61, 2.27.4, or 2.28.1 immediately, where the $request object no longer exposes credential-populated headers to non-admin editors. Until patched, audit workflow sharing settings and revoke or downgrade "use-only" editor access for any user who does not need it on workflows containing credentialed HTTP Request nodes with pagination enabled. Rotate credentials referenced in any shared workflow accessible to non-admin collaborators, and review workflow execution logs/item data exports for evidence of header values appearing in run output as a detection signal for prior abuse.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth Bypass Data Leakage Agent API AML.T0012 - Valid Accounts AML.T0025 - Exfiltration via Cyber Means AML.T0055 - Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6 - AI system security

OWASP LLM Top 10

LLM06:2025 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-59209?

A flaw in n8n's HTTP Request node lets any workflow member with only "use" (non-admin) editor access read credential-populated HTTP headers by referencing the internal $request object inside a pagination expression, then exfiltrate the secret as ordinary item data returned by the node. This matters because n8n is widely used to orchestrate AI agents and API integrations, so the exposed headers are frequently live API keys for LLM providers, vector databases, or other downstream services rather than throwaway tokens — a single leaked key can cascade into billing abuse or a broader supply-chain foothold. There is no CVSS score, EPSS data, CISA KEV listing, public exploit, or Nuclei template for this issue yet, and exploitation requires an already-authenticated collaborator on a shared workflow, which caps the blast radius to insider/over-permissioned-access scenarios rather than opportunistic internet-wide attacks. Patch to n8n 1.123.61, 2.27.4, or 2.28.1 immediately, and in the interim audit who holds "use-only" editor access to workflows containing credentialed HTTP Request nodes and rotate any secrets used in pagination-enabled requests within shared workflows.

Is CVE-2026-59209 actively exploited?

No confirmed active exploitation of CVE-2026-59209 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-59209?

Upgrade n8n to 1.123.61, 2.27.4, or 2.28.1 immediately, where the $request object no longer exposes credential-populated headers to non-admin editors. Until patched, audit workflow sharing settings and revoke or downgrade "use-only" editor access for any user who does not need it on workflows containing credentialed HTTP Request nodes with pagination enabled. Rotate credentials referenced in any shared workflow accessible to non-admin collaborators, and review workflow execution logs/item data exports for evidence of header values appearing in run output as a detection signal for prior abuse.

What systems are affected by CVE-2026-59209?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines.

What is the CVSS score for CVE-2026-59209?

CVE-2026-59209 has a CVSS v3.1 base score of 6.5 (MEDIUM). The EPSS exploitation probability is 0.40%.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration pipelines

MITRE ATLAS Techniques

AML.T0012 Valid Accounts

AML.T0025 Exfiltration via Cyber Means

AML.T0055 Unsecured Credentials

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.6.2.6

OWASP LLM Top 10: LLM06:2025

What are the technical details?

Original Advisory

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

Exploitation Scenario

A contractor or junior team member is granted "use-only" editor access to a shared n8n workflow that calls a paid LLM API via an HTTP Request node configured with pagination and a stored Bearer token credential. The user edits the pagination expression to reference the $request object, which at evaluation time contains the fully-populated request headers including the Authorization header. The node executes, and the credential value now appears in the item data returned to the workflow canvas, where the low-privileged user can view, copy, or export it. The user now holds a live API key for the LLM provider (or other integrated service) and can use it directly, run up billing, or pivot to whatever data/actions that key authorizes outside n8n entirely.

Weaknesses (CWE)

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor Primary CWE-522 Insufficiently Protected Credentials Primary CWE-200 Exposure of Sensitive Information to an Unauthorized Actor CWE-522 Insufficiently Protected Credentials

CWE-200 — Exposure of Sensitive Information to an Unauthorized Actor: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

[Architecture and Design] Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.

Source: MITRE CWE corpus.