Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:n8n:n8n:2.28.0:*:*:*:community:node.js:*:*

1 brief RSS
high advisory

n8n Shared Credential Leakage via HTTP Request Pagination Vulnerability

An authenticated n8n user with 'use-only editor access' can exploit CVE-2026-59209 in shared workflows when `N8N_EXPRESSION_ENGINE=vm` is enabled, allowing them to read sensitive HTTP Header Auth credentials from the `$request.headers` object within a paginated HTTP Request node's expression and exfiltrate them, bypassing credential domain restrictions.

n8n +2 vulnerability credential-access data-exfiltration application-security prototype-pollution authentication-bypass data-enumeration
5t 1c