| Package | Affected versions | Patched versions |
|---|---|---|
| n8n | = 2.28.0≥ 2.0.0, < 2.27.4< 1.123.61 | 2.27.41.123.61 |
| n8n | ≥ 2.0.0-rc.0, < 2.27.4≥ 2.28.0, < 2.28.1< 1.123.61 | 2.27.42.28.11.123.61 |
An authenticated member with use-only editor access to a shared workflow could read credential-populated headers exposed via the $request object inside an HTTP Request node's pagination expression. When an HTTP Header Auth credential is applied to a paginated request, the secret is present in $request.headers when pagination expressions are evaluated. A user-controlled expression could read that secret, copy it into item data, and exfiltrate it through a later HTTP Request node, bypassing credential domain restrictions, since the secret leaves via item data rather than the credential's own request mechanism.
This issue only affects instances with N8N_EXPRESSION_ENGINE=vm set, where paginated HTTP Request workflows using shared credentials are accessible to non-owner users.
The issue has been fixed in n8n versions 1.123.61, 2.27.4, and 2.28.1. Users should upgrade to one of these versions or later to remediate the vulnerability.
If upgrading is not immediately possible, administrators should consider the following temporary mitigations:
These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free