EUVD-2026-47640
GHSA-88c4-pcqm-3r9p
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the required non-default configuration (domain-restricted credential shared with non-owners); S:C and C:H reflect credential exfiltration impacting downstream systems beyond n8n; PR:L for mandatory authentication.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
n8n before 1.123.64, 2.29.8, and 2.30.1 fails to enforce the "Allowed HTTP Request Domains" restriction on HTTP-based credentials (Header Auth, Basic Auth, Query Auth, OAuth) in the GraphQL node, unlike the HTTP Request node. An authenticated user able to create or edit workflows can point the node's endpoint at a server they control and exfiltrate restricted credentials. Only instances where a credential has "Allowed HTTP Request Domains" configured and is usable by non-owner users are affected.
AnalysisAI
Credential exfiltration in n8n's GraphQL node allows authenticated non-owner users to bypass the platform's 'Allowed HTTP Request Domains' domain-restriction policy and route HTTP-based credentials to an attacker-controlled server. Unlike the HTTP Request node, which correctly enforces domain allowlists, the GraphQL node omits this authorization check entirely, meaning any low-privileged workflow editor can redirect HTTP-based credential types - Header Auth, Basic Auth, Query Auth, and OAuth - to an arbitrary endpoint. No public exploit code or active exploitation has been identified at time of analysis; impact is bounded to deployments using domain-restricted shared credentials.
Technical ContextAI
n8n is an open-source workflow automation platform (CPE: cpe:2.3:a:n8n-io:n8n) that allows users to chain integrations using a node-based visual editor. The platform supports HTTP-based credential types (Header Auth, Basic Auth, Query Auth, OAuth) and provides a security feature called 'Allowed HTTP Request Domains' that restricts which external hostnames those credentials can be sent to. The HTTP Request node enforces this allowlist, but the GraphQL node - which also makes outbound HTTP calls and can be bound to arbitrary endpoints - does not. The root cause is CWE-863 (Incorrect Authorization): the authorization check is implemented inconsistently across functionally equivalent node types, creating an exploitable gap in the credential domain-scope enforcement boundary. CPE data covers all n8n versions across the 1.x and 2.x release lines prior to the patched versions.
RemediationAI
Upgrade n8n to version 1.123.64, 2.29.8, or 2.30.1 depending on the active release branch, as confirmed by the vendor advisory at https://github.com/n8n-io/n8n/security/advisories/GHSA-gq66-9cw5-j5jm. Where immediate patching is not possible, restrict workflow creation and editing permissions to credential-owner accounts only, eliminating the non-owner attack surface entirely - this trades collaborative usability for security. As an alternative compensating control, enforce network-level egress filtering on the n8n host to allowlist only trusted external endpoints, which prevents the GraphQL node from reaching attacker-controlled servers even without the credential domain check; this approach does not require configuration changes to n8n itself but must be maintained separately and may block legitimate GraphQL integrations if not scoped carefully. Removing the 'Allowed HTTP Request Domains' configuration from sensitive credentials is not recommended as a workaround because it eliminates the intended security boundary rather than protecting it.
n8n workflow automation (through 1.121.2) allows authenticated users to execute arbitrary code via the n8n service, with
n8n workflow automation (1.65.0 to 1.121.0) allows unauthenticated file access through form-based workflows. A critical
n8n has a fifth critical RCE vulnerability (CVSS 9.9) in the Expression evaluator, enabling code execution through craft
A prototype pollution vulnerability in the XML and GSuiteAdmin nodes of n8n workflow automation platform allows authenti
An authenticated user with workflow creation or modification privileges in n8n workflow automation platform can exploit
n8n-workflows Main Commit ee25413 allows attackers to execute a directory traversal via the download_workflow function w
Authenticated n8n users can hijack administrator accounts when LDAP authentication is enabled by manipulating their LDAP
The n8n package 0.218.0 for Node.js allows Escalation of Privileges. Rated high severity (CVSS 8.8), this vulnerability
SQL injection in n8n's Data Table Get node allows authenticated users with workflow modification permissions to execute
Authenticated users can exploit string formatting and exception handling in n8n's Python task executor to escape sandbox
n8n workflow automation platform Community Edition contains an authorization bypass vulnerability allowing authenticated
The n8n package 0.218.0 for Node.js allows Information Disclosure. Rated high severity (CVSS 7.5), this vulnerability is
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today