Which versions of n8n are affected by CVE-2026-59207?

n8n self-hosted workflow automation (versions prior to 2.27.4 and 2.28.1) allows authenticated low-privilege users to extract and exfiltrate shared workflow credentials to external servers,…. A patch is available.

How to fix or mitigate CVE-2026-59207?

Within 24 hours: inventory all n8n deployments, determine installed versions, and audit AI Agents feature usage with shared credentials. Within 7 days: upgrade to n8n 2.27.4 or 2.28.1, rotate all credentials previously stored in shared workflows, and review system audit logs for unauthorized credential access or exfiltration. Within 30 days: implement principle-of-least-privilege controls on credential sharing, deploy monitoring for suspicious credential usage patterns, and restrict AI Agents feature access to trusted users only.

n8n CVE-2026-59207

Q: What is the CVSS score of CVE-2026-59207?

CVE-2026-59207 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42609 HIGH

Protection Mechanism Failure (CWE-693)

2026-07-09 GitHub_M

GHSA-h44j-f5r5-ph73

Information Disclosure N8n

7.1

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.1 HIGH

Authenticated member (PR:L) over the network; AC:H and S:C because a specific shared-credential/allowlist config is needed and the leaked secret crosses the authorization boundary; impact is chiefly confidentiality (C:H).

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 17:01 EUVD

Analysis Generated

Jul 09, 2026 - 16:23 vuln.today

DescriptionCVE.org

n8n is an open source workflow automation platform. Prior to 2.27.4 and 2.28.1, the AI Agents feature did not enforce the Allowed HTTP Request Domains restriction configured on credentials when an MCP tool was pointed at an arbitrary URL, allowing a member-level user with use-only access to a shared credential to send its secret to an external server they control. This issue is fixed in versions 2.27.4 and 2.28.1.

AnalysisAI

Credential secret exfiltration in n8n (self-hosted workflow automation) prior to 2.27.4 and 2.28.1 lets a low-privilege member with use-only access to a shared credential leak that secret to an attacker-controlled server. The AI Agents feature fails to enforce the 'Allowed HTTP Request Domains' restriction when an MCP tool is aimed at an arbitrary URL, so the guardrail meant to keep secrets in-bounds is bypassed. No public exploit identified at time of analysis; risk is elevated because the abuse comes from an already-authorized internal user rather than an outside attacker.

Technical ContextAI

n8n is a Node.js-based, fair-code workflow automation platform where users build workflows from nodes, including AI Agent nodes that can invoke external tools via the Model Context Protocol (MCP). Credentials in n8n support an 'Allowed HTTP Request Domains' allowlist intended to bind a credential's secret to a fixed set of destinations, and n8n's sharing model distinguishes 'use-only' access (a member can execute a workflow with a credential but cannot read its plaintext secret) from full access. The flaw maps to CWE-693 (Protection Mechanism Failure): the domain-allowlist control that should gate outbound requests is not applied along the MCP-tool code path, so an AI Agent can be pointed at an arbitrary URL and carry the credential secret to it, defeating the very isolation that use-only sharing is supposed to guarantee.

RemediationAI

Vendor-released patch: upgrade to n8n 2.27.4 (https://github.com/n8n-io/n8n/releases/tag/n8n%402.27.4) or 2.28.1 (https://github.com/n8n-io/n8n/releases/tag/n8n%402.28.1), depending on your release train, as documented in advisory GHSA-h44j-f5r5-ph73. If you cannot patch immediately, reduce exposure by revoking use-only shares of sensitive credentials to member-level users and limiting credential sharing to trusted operators; disable or restrict the AI Agent / MCP tool nodes so members cannot point them at arbitrary URLs; and place egress filtering in front of the n8n host so outbound HTTP from workflow execution can only reach approved domains, which enforces the intended allowlist at the network layer. Trade-offs: tightening credential sharing and disabling MCP tooling will break legitimate automations that depend on them, and network egress filtering adds operational overhead and can silently break integrations, so validate against known-good workflows before enforcing.