CVE-2026-65589

medium

Description

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.

References

Advisories

https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-node-execution-data

https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2

Details

Source: Mitre, NVD

Published: 2026-07-22

Updated: 2026-07-27

Risk Information

CVSS v2

Base Score: 6.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Severity: Medium

CVSS v4

Base Score: 5.1

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N

Severity: Medium

EPSS

EPSS: 0.00485