CyberRota Analysis
AI-Generatedn8n versions prior to 2.28.1 are vulnerable to an information disclosure flaw that allows authenticated project editors to access plaintext external secret values through workflow node expressions, bypassing necessary permissions. This could lead to unauthorized exposure of sensitive information within workflows. Organizations using n8n for automation should prioritize updating to the latest version to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.