The vulnerability allows an authenticated user who does not have permission to list external secrets to read the plain text value of a secret when a credential is saved in n8n. By referencing a secret through its external name, the system bypasses the externalSecret:list permission check, exposing secrets stored in connected vaults that would normally require admin or owner privileges. This results in unauthorized disclosure of sensitive information.

Affected vendors and versions include n8n‑io n8n prior to version 2.6.4 and version 1.123.23. The flaw is present only when an external secrets vault is configured, and the user must be able to guess or know the target secret's name.

The flaw carries a CVSS score of 7.3, indicating high severity, but an EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker requires valid credentials, the ability to create or edit credentials, and knowledge of a secret name. Because the attack takes place within the n8n instance, the impact is confined to the secrets stored in the connected vault, but it can potentially compromise any sensitive data exposed through that vault.