CVE-2026-59209— n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-59209
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
Source: CVE Program / CVE List V5
Vulnerability Description
n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
Source: CVE Program / CVE List V5
Vulnerability Title
n8n 信息泄露漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
n8n是n8n公司开源的一个可扩展的工作流自动化工具。 n8n存在安全漏洞，该漏洞源于已认证成员可通过$request对象读取填充了凭证的标头，可能导致秘密信息泄露。以下版本受到影响：1.123.61之前版本、2.27.4之前版本和2.28.1之前版本。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-59209
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-59209
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-59209 (1)
- 🔗 Release n8n@2.27.4 · n8n-io/n8n · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-59209 (1)
Vendor Pages for CVE-2026-59209 (1)
- 🔗 Release n8n@2.28.1 · n8n-io/n8n · GitHubx_refsource_MISC
Same Patch Batch · n8n-io · 2026-07-09 · 4 CVEs total
| CVE-2026-59208 | n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution | |
| CVE-2026-59207 | n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector | |
| CVE-2026-59206 | n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Projec |
IV. Related Vulnerabilities
Same product: n8n
- CVE-2026-65599
n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure - CVE-2026-65598
n8n before 1.123.64 Remote Code Execution via Git Clone - CVE-2026-65597
n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe - CVE-2026-65596
n8n before 1.123.64 Credential Exfiltration via GraphQL Node - CVE-2026-65595
n8n before 2.29.8 and 2.30.1 Privilege Escalation via Token
Same vendor: n8n-io
- CVE-2026-65599
n8n before 1.123.64, 2.29.8, and 2.30.1 Credential Exposure - CVE-2026-65597
n8n before 1.123.64 DOM-Based XSS via Unsandboxed iframe - CVE-2026-65598
n8n before 1.123.64 Remote Code Execution via Git Clone - CVE-2026-65596
n8n before 1.123.64 Credential Exfiltration via GraphQL Node - CVE-2026-65594
n8n before 2.30.1 Missing OAuth Authorization Check
V. Comments for CVE-2026-59209
No comments yet