What is CVE-2026-65589?

CVE-2026-65589 is a medium-severity vulnerability in N8n, classified under Insertion of Sensitive Information into Log File. CVSS score: 6.5/10. Published 2026-07-22.

How severe is CVE-2026-65589?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Information disclosure in N8n

CVE-2026-65589

n8n versions before 1.123.64 fail to properly mask custom HTTP header credentials in LLM sub-node execution data, writing plaintext API keys and secrets to workflow execution records. Authenticated users with access to execution data can read exposed header values and credentials that persist in the database and can be exported.

EPSS: 0.004 (30.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

N8n — versions 2.30.0
N8n-io N8n — versions 0, 1.123.64, 2.30.1

Weakness classification (CWE)

CWE-532 — Insertion of Sensitive Information into Log File

References

disclosure@vulncheck.com (vendor-advisory, Mitigation, Vendor Advisory)
disclosure@vulncheck.com (Third Party Advisory, third-party-advisory)

Frequently asked questions

What is CVE-2026-65589?: CVE-2026-65589 is a medium-severity vulnerability in N8n, classified under Insertion of Sensitive Information into Log File. CVSS score: 6.5/10. Published 2026-07-22.
How severe is CVE-2026-65589?: Medium severity. CVSS v3 base score is 6.5 out of 10.