CVE-2026-65589 MEDIUM

CVE-2026-65589: n8n before 1.123.64 Credential Exposure via LLM Node Execution Data

Vendor N8N-Io
Product n8n
Weakness CWE-532 · Sensitive info in logs
Published July 22, 2026
Last update July 22, 2026
View on NVD All CVEs

CVSS base score

5.1/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N

What the vulnerability does

01Description

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.

Key dates

02Disclosure timeline

July 22, 2026 CVE published

Related vulnerabilities

04Related CVE

CVE-2024-32953 WordPress Newsletters plugin <= 4.9.5 - Sensitive Data Exposure vulnerability CVE-2024-31254 WordPress WordPress Backup & Migration plugin <= 1.4.7 - Sensitive Data Exposure via Log File vulnerability CVE-2024-30511 WordPress FG PrestaShop to WooCommerce plugin <= 4.45.1 - Sensitive Data Exposure via Log File vulnerability CVE-2021-25009 CorreosExpress <= 2.6.0 - Sensitive Information Disclosure CVE-2025-10486 Content Writer <= 3.6.8 - Unauthenticated Information Exposure via Log File