The vulnerability arises from a mismatch between static validation checks on credential forms and the runtime expression engine used by n8n. An authenticated user who can create or update credentials but does not possess the externalSecret:list scope can embed references to external secrets in the form fields. The static validation does not detect these references, yet the expression engine resolves them at workflow execution time, leaking secret values to the attacker. This flaw represents a privilege‑level bypass that allows an unauthorized user to read protected data, classifying it as a CWE-639 weakness.

Instances running n8n prior to version 1.123.61, 2.27.4, or 2.28.1 are affected when an external secrets provider is configured and Advanced Permissions are enabled. Users who have permission to create or update credentials but lack the externalSecret:list scope can exploit this flaw by embedding malicious references into credentials, thereby gaining access to secrets they should not see.

The recorded CVSS score of 6 indicates moderate severity, and the EPSS value of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in CISA KEV, so no widespread exploitation has been reported. An attacker needs to be authenticated and have creation or update rights for credentials, making the attack feasible in environments where such permissions are granted without the necessary externalSecret:list scope. Once exploited, the attacker can obtain any external secret referenced in the injected expressions.