GHSA-fxcw-h3qj-8m8p
n8n Has External Secrets Authorization Bypass in Credential Saving
Details
## Impact An authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the `externalSecret:list` permission check and allowed access to secrets stored in connected vaults without admin or owner privileges.
- This issue requires the instance to have an external secrets vault configured. - The attacker must know or be able to guess the name of a target secret.
## Patches The issue has been fixed in n8n versions 1.123.23 and 2.6.4. Users should upgrade to one of these versions or later to remediate the vulnerability.
## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n access to fully trusted users only. - Disable external secrets integration until the patch can be applied.
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Are you affected?
Enter the version of the package you're using.