The flaw lies in the way n8n evaluates node expressions, allowing an authenticated user with project editor rights to reference an external secret that is linked to the organization or a different project. Because the expression evaluation does not enforce secret scoping, the secret value is returned in plaintext in the workflow execution result. This information disclosure can reveal credentials, tokens, API keys, or any other confidential data that the external secret contains. The weakness is a classic case of improper authorization (CWE-639).

Installed copies of the n8n workflow automation platform running any version earlier than 2.28.1 are vulnerable. The vulnerability exists in the core expression evaluator that processes node expressions in all workflow types, regardless of the workflow type or the type of node used.

A CVSS score of 6.3 indicates moderate severity, and the EPSS score of less than 1% shows a low likelihood that attackers will target this flaw. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires an attacker to be authenticated as a project editor and to modify or read a workflow that references an external secret; no privilege escalation or remote code execution is involved, so the impact is confined to the disclosure of sensitive data that the project editor can actually read.