n8n CVE-2026-59207

Exploitation requires an authenticated member-level account (PR:L) that has been granted use-only access to a shared credential which has an 'Allowed HTTP Request Domains' restriction configured, plus a deployment where the AI Agents feature and MCP tools are enabled and the member can create/edit a workflow that aims an MCP tool at an attacker-chosen URL. Limiting factors: this is not exploitable against a default install with no shared credentials or no AI Agent/MCP usage, and it needs a valid internal account, so it is an authenticated privilege-boundary bypass (use-only user escalating to secret disclosure) rather than remote unauthenticated exploitation; there is no user-interaction requirement from a victim, and the attacker must already be inside the tenant.

The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N, VC:H, SC:H) scoring 7.1 High is internally consistent with the description: network-reachable, low attacker privilege (a member account), no user interaction, but with an Attack Requirement (AT:P) reflecting that a shared credential configured with a domain allowlist must actually exist. The dominant impact is confidentiality - the high value is the leaked secret (VC:H and subsequent-system SC:H), while integrity/availability are minimal. There is no CISA KEV listing and no POC referenced, so there is no public exploit identified at time of analysis; EPSS was not supplied. This is a genuine insider/privilege-boundary risk rather than a mass-exploitation internet threat: it requires an existing authenticated foothold and a specific sharing configuration, which lowers real-world urgency compared to an unauthenticated RCE, but the payoff (theft of a secret the user was explicitly not permitted to read, e.g. an API key or OAuth token) can be severe and enable lateral movement into whatever service that credential unlocks.

A member-level user who has been granted use-only access to a shared API credential builds or edits a workflow with an AI Agent node, attaches an MCP tool, and points it at a URL on a server they control. Because the 'Allowed HTTP Request Domains' restriction is not enforced on that path, executing the workflow sends the credential's secret to their external endpoint, handing them a key they were never authorized to read. No public POC is referenced, and the attack requires only an existing member account plus the shared-credential configuration (CVSS AC:L, PR:L, UI:N).