Which versions of Hashicorp are affected by CVE-2026-33722?

A HIGH severity vulnerability in n8n workflow automation allows authenticated employees to illegally access sensitive secrets stored in external vaults, potentially exposing API keys, database…. A patch is available.

Is there a public PoC exploit available for CVE-2026-33722?

Yes, a public proof-of-concept exploit is available for CVE-2026-33722. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-33722?

Within 24 hours: Inventory all n8n deployments and identify instances with external vault configurations; disable external secrets vault integration if business-critical. Within 7 days: Audit access logs for suspicious secret retrieval attempts; reset all credentials accessed through affected n8n instances; engage n8n support for patch timeline. Within 30 days: Implement network segmentation to restrict n8n's vault access; enforce least-privilege credential access policies; deploy additional monitoring on vault access patterns.

Hashicorp CVE-2026-33722

Q: What is the CVSS score of CVE-2026-33722?

CVE-2026-33722 has a CVSS 4.0 base score of 7.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-15953 HIGH

Incorrect Authorization (CWE-863)

2026-03-25 GitHub_M

GHSA-fxcw-h3qj-8m8p

Authentication Bypass Hashicorp

7.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

PoC Detected

Mar 27, 2026 - 19:34 vuln.today

Public exploit code

EUVD ID Assigned

Mar 25, 2026 - 18:32 euvd

EUVD-2026-15953

Analysis Generated

Mar 25, 2026 - 18:32 vuln.today

CVE Published

Mar 25, 2026 - 18:09 nvd

HIGH 7.3

DescriptionGitHub Advisory

n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the externalSecret:list permission check and allowed access to secrets stored in connected vaults without admin or owner privileges. This issue requires the instance to have an external secrets vault configured. The attacker must know or be able to guess the name of a target secret. The issue has been fixed in n8n versions 1.123.23 and 2.6.4. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Restrict n8n access to fully trusted users only, and/or disable external secrets integration until the patch can be applied. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

AnalysisAI

Authenticated users in n8n versions prior to 1.123.23 and 2.6.4 can bypass external secrets permission checks to retrieve plaintext secret values from configured vaults by referencing secrets by name in credentials, even without list permissions. This allows unauthorized access to sensitive vault-stored credentials without requiring admin or owner privileges, provided the attacker knows or can guess the target secret name. Public exploit code exists for this vulnerability.

Technical ContextAI

n8n is an open-source workflow automation platform identified by CPE cpe:2.3:a:n8n-io:n8n. The vulnerability is classified as CWE-863 (Incorrect Authorization), meaning the application fails to properly enforce authorization checks when users attempt to access external secrets. The issue stems from inadequate permission validation in the credential saving workflow, where the system checks for externalSecret:list permission but allows authenticated users to bypass this control by directly referencing external secret names during credential creation or modification. The Hashicorp tag suggests integration with Hashicorp Vault or similar external secrets management systems, where the application retrieves secrets but fails to validate whether the requesting user has appropriate access rights before returning plaintext values.

RemediationAI

Upgrade n8n to version 1.123.23 or later for the legacy branch, or version 2.6.4 or later for the current branch to fully remediate the vulnerability. Patches are available through the official GitHub repository and detailed in the security advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-fxcw-h3qj-8m8p. If immediate patching is not feasible, administrators should implement temporary mitigations including restricting n8n instance access to fully trusted users only through authentication controls or network segmentation, and disabling external secrets vault integration until the patch can be applied. Note that these workarounds provide only partial risk reduction and should be considered short-term measures only, as they do not address the underlying authorization flaw.