CVE-2026-33722: n8n Has External Secrets Authorization Bypass in Credential Saving

An authenticated user without permission to list external secrets could reference a secret by the external name in a credential and retrieve its plaintext value when saving the credential. This bypassed the externalSecret:list permission check and allowed access to secrets stored in connected vaults without admin or owner privileges.

• This issue requires the instance to have an external secrets vault configured.
• The attacker must know or be able to guess the name of a target secret.