What is GHSA-3j7v-fhjg-6rh2?

GHSA-3j7v-fhjg-6rh2 is a security advisory published by GitHub Security Advisories with Medium severity. Duplicate Advisory: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

Why does GHSA-3j7v-fhjg-6rh2 have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

Which products are affected by GHSA-3j7v-fhjg-6rh2?

GHSA-3j7v-fhjg-6rh2 affects 1 product, including: npm/n8n:\u003c 2.27.4.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: July 22, 2026

GHSA-3j7v-fhjg-6rh2MediumDisclosed before NVD

Duplicate Advisory: n8n: External Secrets Accessible via Workflow Expressions Outside Credentials

Vendor

GitHub Security Advisories

Published

July 15, 2026

Last Modified

July 22, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-2434-3x6q-8r99. This link is maintained to preserve external references.

Original Description

n8n before 2.28.1 contains an information disclosure vulnerability where external secrets are incorrectly resolved in workflow node expressions outside credentials scope. Authenticated project editors can read plaintext external secret values by referencing them in node expressions without requiring explicit secrets access permissions.

🎯 Affected products1

npm/n8n:< 2.27.4

🔗 References (4)

https://github.com/n8n-io/n8n/security/advisories/GHSA-2434-3x6q-8r99
https://nvd.nist.gov/vuln/detail/CVE-2026-59254
https://www.vulncheck.com/advisories/n8n-external-secrets-disclosure-via-workflow-node-expressions
https://github.com/advisories/GHSA-3j7v-fhjg-6rh2