PT-2026-63347 · N8N · N8N

CVE-2026-65589 · Published 2026-07-22 · Updated 2026-07-22

Positive Technologies (AI Summary)

CVSS v4.0

5.1

Medium

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.64

Description Custom HTTP header credentials used in LLM sub-nodes, such as OpenAI, Anthropic, and Lemonade, are not properly masked during execution. While these values appear masked in the user interface, they are written in plaintext to workflow execution records. Authenticated users with access to this execution data can read sensitive information, such as API keys and secrets, which are persisted in the database and can be exported.

Recommendations Update to version 1.123.64, 2.29.8, 2.30.1, or later. Restrict access to execution data to fully trusted users only. Avoid configuring custom headers in LLM node credentials and use alternative authentication mechanisms. Rotate any API keys or secrets that may have been stored as custom header values in affected credentials.

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-65589

GHSA-89GH-3PGC-V5H2

Affected Products

N8N

References · 8

• https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-89gh-3pgc-v5h2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-65589 · Security Note
• https://github.com/n8n-io/n8n · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.30.1 · Note
• https://vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-node-execution-data · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@1.123.64 · Note
• https://github.com/n8n-io/n8n/releases/tag/n8n@2.29.8 · Note