n8n External Secrets Permission Bypass via Expression Parser Mismatch

Technical Analysis

n8n's credential validation logic checks expressions for external secret references using a static parser that does not fully match the capabilities of the runtime expression engine used during workflow execution. An attacker with credential create/update permissions but lacking `externalSecret:list` scope can craft an expression form that evades the static check yet is still correctly interpreted and resolved by the runtime engine when the workflow executes. This effectively lets a lower-privileged user pull values from external secret stores (e.g., HashiCorp Vault, AWS Secrets Manager integrations) they are not authorized to enumerate or read directly. The vulnerability crosses a trust boundary between n8n's permission/authorization layer and its expression evaluation engine, a pattern directly analogous to agentic tool-layer boundary bypasses where a tool's declared/validated capability diverges from its actual runtime behavior.

Affected Systems

n8n

Detection Signatures

• Audit credential objects for expression syntax referencing external secret provider namespaces (e.g., $secrets.* or similar) added by users lacking externalSecret:list scope
• Review workflow execution logs for resolved secret values appearing in output/logs that correspond to credentials edited by non-privileged users
• Monitor credential create/update events correlated with users who lack externalSecret:list permission
• Diff static validation results against runtime expression evaluation output for credential fields

Remediation Steps

1. 1

   Upgrade n8n

   Update to n8n 1.123.61, 2.27.4, 2.28.1, or later where the validation/runtime parser mismatch is fixed.

2. 2

   Restrict credential permissions

   Until patched, limit credential create/update rights to fully trusted administrators only.

3. 3

   Audit existing credentials

   Review all existing credentials for unexpected or suspicious external secret references that may indicate prior exploitation.

4. 4

   Enable enhanced logging

   Monitor and log workflow executions that resolve external secret values, correlating with the identity and permission scope of the credential author.