Cyber Resilience

CVE-2026-33722

Access Control in N8N ≤ 1.123.23

Published
25 March 2026
Modified
27 March 2026
Patch / advisory
CVSS Score v4 7.3
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0026 18th percentile
Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-33722 is a high-severity Incorrect Authorization (CWE-863) vulnerability in N8N N8N. Its CVSS base score is 7.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unsecured Credentials (T1552); ranked at the 18th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

n8n is an open source workflow automation platform. Prior to versions 2.6.4 and 1.123.23, an authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when…

more

saving the credential. This bypassed the `externalSecret:list` permission check and allowed access to secrets stored in connected vaults without admin or owner privileges. This issue requires the instance to have an external secrets vault configured. The attacker must know or be able to guess the name of a target secret. The issue has been fixed in n8n versions 1.123.23 and 2.6.4. Users should upgrade to one of these versions or later to remediate the vulnerability. If upgrading is not immediately possible, administrators should consider the following temporary mitigations: Restrict n8n access to fully trusted users only, and/or disable external secrets integration until the patch can be applied. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Why these techniques?

Authz bypass directly enables unauthorized retrieval of plaintext secrets/credentials from external vaults.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-65596Same product: N8N N8N
CVE-2026-54307Same product: N8N N8N
CVE-2026-59259Same product: N8N N8N
CVE-2026-33720Same product: N8N N8N
CVE-2026-56775Same product: N8N N8N
CVE-2026-33663Same product: N8N N8N
CVE-2026-56778Same product: N8N N8N
CVE-2026-25631Same product: N8N N8N
CVE-2026-56776Same product: N8N N8N
CVE-2026-56348Same product: N8N N8N

Affected Assets

n8n
n8n
≤ 1.123.23 · 2.0.0 — 2.6.4

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)
  • AC-3 Access Enforcement
  • AC-6 Least Privilege
  • AC-4 Information Flow Enforcement
Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 5 hardening rules · 3 OS baselines
Validate
Prove the fix (OWASP ASVS)

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly enforces the externalSecret:list permission that the CVE bypasses when a credential references a vault secret by name.

prevent

Ensures users cannot obtain secret values without the explicit list permission, limiting the impact of the authorization flaw.

prevent

Enforces information-flow rules that should have blocked plaintext secret retrieval into user credentials without proper authorization.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Defining, enforcing, and reviewing access authorizations and least privilege directly prevents incorrect authorization checks.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring consistency between access rights and classification plus formal approval steps ensures that the authorization logic correctly distinguishes between entities that should and should not be granted access.

prevents

Enforcing policy-driven approval and role-change reviews stops incorrect or stale authorization decisions from remaining in effect after job changes or terminations.

prevents

By tying access rights to identity, device, location and classification, the control reduces the likelihood that an authorization decision will be based on an incorrect or bypassed policy.

References