CVE-2026-59209

Katalog CVE

CVSS 6.5 · Medium EPSS 0,40%

Kerentanan Exposure of Sensitive Information to an Unauthorized Actor pada n8n. Skor CVSS 3.1 6.5 (Medium) menurut NVD.

Deskripsi (NVD)

n8n is an open source workflow automation platform. Prior to 1.123.61, 2.27.4, and, 2.28.1, an authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression and exfiltrate the secret through item data. This issue is fixed in versions 1.123.61, 2.27.4, and 2.28.1.

Rincian

Terbit di NVD

9 Juli 2026

Terakhir diubah

13 Juli 2026

Status NVD

Analyzed

CVSS 3.1

6.5 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CWE-522: Insufficiently Protected Credentials

EPSS (30 hari)

0,40% peluang dieksploitasi; lebih tinggi dari 32,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/n8n-io/n8n/security/advisories/GHSA-q3j5-8vrg-4p9q mitigasi · advisory vendor
• https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4 product · release notes
• https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1 product · release notes