An authentication‑based bypass in n8n allows a user who does not have permissions to list external secrets to reference a secret by name while saving a credential, resulting in the secret’s plaintext being exposed. This issue bypasses the externalSecret:list check and grants secret disclosure even to users without admin or owner privileges. The weakness is an authorization bypass (CWE‑863) that directly compromises confidentiality of secrets stored in connected vaults.

The flaw affects the open‑source workflow automation platform n8n from n8n‑io. Any installation running a version earlier than 2.6.4 or 1.123.23 that has external secrets integration enabled is vulnerable. Users must know or guess the external name of a target secret to exploit the bug.

The vulnerability carries a CVSS base score of 7.3, indicating high severity. EPSS data is not reported, and the issue is not listed in the CISA KEV catalog, but the attack is nevertheless feasible for authenticated users who can guess a secret name. The impact is substantial, as exposed secrets could leak privileged credentials or other sensitive data, potentially compromising connected services. The attack vector is through the credential‑saving API, requiring only valid authentication and knowledge of a secret’s external identifier.