N8n CVE-2026-33722

Requires n8n versions prior to 2.6.4 or 1.123.23 with external secrets vault configured. Attacker needs valid n8n user credentials (any authenticated user), knowledge or ability to guess target secret name, and ability to save/edit credentials. No victim interaction needed.

The CVSS v4.0 score of 7.3 reflects high confidentiality impact with network attack vector, low complexity, and low privileges required, though attack requires present conditions (AT:P) indicating the need for external vault configuration and knowledge of secret names. The vulnerability enables privilege escalation from authenticated users to accessing admin-level secrets, presenting genuine risk in multi-tenant or role-separated environments. The CVSS vector shows high subsequent system confidentiality, integrity, and availability impacts (SC:H/SI:H/SA:H), indicating potential for broader compromise beyond the vulnerable component itself. Real-world risk is moderate to high for organizations using n8n with external vault integration, as authenticated insider threats or compromised low-privilege accounts could harvest sensitive credentials. The requirement for vault configuration and secret name knowledge reduces attack surface compared to unauthenticated or zero-knowledge exploits, but the low attack complexity (AC:L) means exploitation is straightforward once prerequisites are met.

An authenticated user with limited privileges in an n8n instance with Hashicorp Vault integration creates or modifies a workflow credential configuration, intentionally referencing external secret names obtained through social engineering or systematic enumeration of common naming patterns like 'database_password' or 'api_key_prod'. When saving the credential, the system bypasses the externalSecret:list permission check and retrieves the plaintext secret value from the vault, allowing the low-privilege user to exfiltrate sensitive credentials normally restricted to administrators or owners for use in unauthorized activities or lateral movement.