CVE-2026-65589 — MEDIUM (6.5)

Q: How severe is CVE-2026-65589?

CVE-2026-65589 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Q: Is there a patch for CVE-2026-65589?

Check the references section above for vendor advisories and patch information. Affected products include: N8N N8N.

Vulnerability Description

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.

CVSS Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality

HIGH

Integrity

NONE

Availability

NONE

Affected Products

Vendor	Product	Versions
N8N	N8N	< 1.123.64

Related Weaknesses (CWE)

CWE-532

References

https://github.com/n8n-io/n8n/security/advisories/GHSA-89gh-3pgc-v5h2MitigationVendor Advisory
https://www.vulncheck.com/advisories/n8n-before-credential-exposure-via-llm-nodeThird Party Advisory

FAQ

What is CVE-2026-65589?

CVE-2026-65589 is a vulnerability with a CVSS score of 6.5 (MEDIUM). n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated us...

How severe is CVE-2026-65589?

CVE-2026-65589 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2026-65589?

Check the references section above for vendor advisories and patch information. Affected products include: N8N N8N.