PT-2026-28082 · N8N · N8N

Published 2026-03-25 · Updated 2026-03-26 · CVE-2026-33722

Positive Technologies (AI Summary)

CVSS v4.0

7.3

High

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.23 n8n versions prior to 2.6.4

Description An authenticated user lacking the necessary permissions could access secrets stored in connected vaults by referencing them by name when saving credentials. This bypasses the externalSecret:list permission check. The issue requires an external secrets vault to be configured and the attacker must know or guess the target secret's name.

Recommendations Upgrade to n8n version 1.123.23 or later. Upgrade to n8n version 2.6.4 or later. Restrict n8n access to fully trusted users only. Disable external secrets integration until a patch can be applied.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2026-33722

GHSA-FXCW-H3QJ-8M8P

Affected Products

N8N

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33722.json · Exploit
• https://github.com/n8n-io/n8n/security/advisories/GHSA-fxcw-h3qj-8m8p · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fxcw-h3qj-8m8p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33722 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33722 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://reddit.com/r/VulnMatter/comments/1s473iq/resumen_diario_de_vulnerabilidades_26032026 · Reddit Post
• https://reddit.com/r/VulnMatter/comments/1s475si/resumen_diario_de_vulnerabilidades_26032026 · Reddit Post
• https://twitter.com/algonovalabs/status/2036950489682895013 · Twitter Post
• https://twitter.com/CVEnew/status/2036911815054286921 · Twitter Post