CVE-2026-65589: n8n plaintext credential leak

Q: Is CVE-2026-65589 actively exploited?

No confirmed active exploitation of CVE-2026-65589 has been reported, but organizations should still patch proactively.

Q: How to fix CVE-2026-65589?

Upgrade to n8n 1.123.64 or later, which is expected to mask header credential values in execution records. Immediately rotate every API key or secret that has ever been passed via a custom HTTP header in an LLM sub-node, since historical execution records containing the plaintext values will remain in the database even after patching unless purged. Restrict execution-data view permissions to the minimum necessary roles, audit who has exported execution history recently, and review database backups/exports for lingering plaintext secrets. Going forward, prefer n8n's built-in credential store (which is masked) over raw custom headers for any authentication material.

Q: What systems are affected by CVE-2026-65589?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving, workflow orchestration.

Q: What is the CVSS score for CVE-2026-65589?

No CVSS score has been assigned yet.

CISO Take

n8n's LLM sub-nodes fail to mask custom HTTP header values before writing them into workflow execution records, so API keys and secrets configured for header-based authentication to LLM providers or other backend services persist in plaintext inside the database and in any exported execution logs. Any authenticated user who can view execution data — including team members with limited workflow permissions — can read these credentials, turning a routine 'view execution history' action into a credential harvesting opportunity that reaches across n8n's 16 downstream integrations. There is no CVSS score, EPSS percentile, CISA KEV listing, public exploit, or Nuclei template for this issue yet, and exploitation requires an existing authenticated account rather than unauthenticated remote access, which tempers urgency relative to a network-facing flaw — though the package already carries 150 other CVEs and a middling 6.6/10 OpenSSF Scorecard, pointing to broader operational hygiene risk. Patch to n8n 1.123.64 or later immediately, then rotate any API keys or secrets ever passed via custom HTTP headers in LLM sub-nodes, and audit execution history exports plus shared-workspace access for signs of exposure.

Sources: NVD GitHub Advisory ATLAS OpenSSF

What is the risk?

Low-to-moderate exploitability since a valid authenticated account with execution-data access is a prerequisite — this is not remotely exploitable by an unauthenticated attacker and has no known public exploit, scanner template, EPSS score, or KEV listing. However, impact is significant where realized: credentials are secrets used to authenticate to LLM APIs or other integrated services, and plaintext persistence in the database means the exposure is durable (not a one-time leak) and compounds with every workflow run and every export of execution data. Risk rises sharply in multi-tenant or team-shared n8n instances where least-privilege on execution history isn't enforced, since insider threat or a single compromised low-privilege account becomes a path to lateral credential harvesting.

How does the attack unfold?

Authenticated Access

An adversary obtains or already holds a valid, low-privilege authenticated account on the n8n instance (employee, contractor, or compromised credential).

AML.T0012

Vulnerable Execution Logging

A workflow using an LLM sub-node with custom HTTP header credentials runs, and n8n writes the unmasked header values into the execution record stored in the database.

Credential Discovery

The adversary views or exports execution data they have legitimate access to and reads the exposed plaintext API keys/secrets.

AML.T0055

Credential Reuse / Impact

The harvested credential is used directly against the connected LLM API, RAG backend, or internal service to access data or resources beyond the adversary's authorized scope.

AML.T0091

Authenticated Access

An adversary obtains or already holds a valid, low-privilege authenticated account on the n8n instance (employee, contractor, or compromised credential).

AML.T0012

Vulnerable Execution Logging

A workflow using an LLM sub-node with custom HTTP header credentials runs, and n8n writes the unmasked header values into the execution record stored in the database.

Credential Discovery

The adversary views or exports execution data they have legitimate access to and reads the exposed plaintext API keys/secrets.

AML.T0055

Credential Reuse / Impact

The harvested credential is used directly against the connected LLM API, RAG backend, or internal service to access data or resources beyond the adversary's authorized scope.

AML.T0091

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	< 1.123.64	`1.123.64`
204.1K OpenSSF 6.6 16 dependents Pushed 7d ago 53% patched ~5d to patch Full package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 31% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Trivial

What should I do?

1 step

Upgrade to n8n 1.123.64 or later, which is expected to mask header credential values in execution records. Immediately rotate every API key or secret that has ever been passed via a custom HTTP header in an LLM sub-node, since historical execution records containing the plaintext values will remain in the database even after patching unless purged. Restrict execution-data view permissions to the minimum necessary roles, audit who has exported execution history recently, and review database backups/exports for lingering plaintext secrets. Going forward, prefer n8n's built-in credential store (which is masked) over raw custom headers for any authentication material.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Data Leakage Privacy Violation Agent Plugin API AML.T0036 - Data from Information Repositories AML.T0055 - Unsecured Credentials AML.T0098 - AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15 - Accuracy, robustness and cybersecurity

ISO 42001

Annex A.7 - AI system data and resource security

NIST AI RMF

MEASURE 2.7 - AI system security and resilience evaluation

OWASP LLM Top 10

LLM06 - Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-65589?

n8n's LLM sub-nodes fail to mask custom HTTP header values before writing them into workflow execution records, so API keys and secrets configured for header-based authentication to LLM providers or other backend services persist in plaintext inside the database and in any exported execution logs. Any authenticated user who can view execution data — including team members with limited workflow permissions — can read these credentials, turning a routine 'view execution history' action into a credential harvesting opportunity that reaches across n8n's 16 downstream integrations. There is no CVSS score, EPSS percentile, CISA KEV listing, public exploit, or Nuclei template for this issue yet, and exploitation requires an existing authenticated account rather than unauthenticated remote access, which tempers urgency relative to a network-facing flaw — though the package already carries 150 other CVEs and a middling 6.6/10 OpenSSF Scorecard, pointing to broader operational hygiene risk. Patch to n8n 1.123.64 or later immediately, then rotate any API keys or secrets ever passed via custom HTTP headers in LLM sub-nodes, and audit execution history exports plus shared-workspace access for signs of exposure.

Is CVE-2026-65589 actively exploited?

No confirmed active exploitation of CVE-2026-65589 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-65589?

Upgrade to n8n 1.123.64 or later, which is expected to mask header credential values in execution records. Immediately rotate every API key or secret that has ever been passed via a custom HTTP header in an LLM sub-node, since historical execution records containing the plaintext values will remain in the database even after patching unless purged. Restrict execution-data view permissions to the minimum necessary roles, audit who has exported execution history recently, and review database backups/exports for lingering plaintext secrets. Going forward, prefer n8n's built-in credential store (which is masked) over raw custom headers for any authentication material.

What systems are affected by CVE-2026-65589?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, RAG pipelines, model serving, workflow orchestration.

What is the CVSS score for CVE-2026-65589?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksRAG pipelinesmodel servingworkflow orchestration

MITRE ATLAS Techniques

AML.T0036 Data from Information Repositories

AML.T0055 Unsecured Credentials

AML.T0098 AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: Annex A.7

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM06

What are the technical details?

Original Advisory

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.

Exploitation Scenario

A contractor or junior team member is granted read access to a shared n8n instance to review workflow outputs for an AI-agent-based customer support pipeline. While browsing execution history for debugging purposes, they open a run's execution data and find the full plaintext API key used in a custom HTTP header to authenticate the LLM sub-node to the company's internal RAG retrieval API. They copy the key and use it directly against the RAG API outside of n8n, bypassing any workflow-level guardrails, rate limits, or audit logging that the agent orchestration layer would normally provide, and exfiltrate proprietary documents indexed in the RAG backend.

Weaknesses (CWE)

CWE-532 Insertion of Sensitive Information into Log File Primary CWE-532 Insertion of Sensitive Information into Log File Primary CWE-532 Insertion of Sensitive Information into Log File

CWE-532 — Insertion of Sensitive Information into Log File: The product writes sensitive information to a log file.

[Architecture and Design, Implementation] Consider seriously the sensitivity of the information written into log files. Do not write secrets into the log files.
[Distribution] Remove debug log files before deploying the application into production.

Source: MITRE CWE corpus.