n8n CVE-2026-77081

Exploitation requires an authenticated n8n account with workflow-authoring (create or edit) rights - unauthenticated attackers cannot exploit this. The GraphQL node's Authentication parameter must be explicitly set to expression mode (not the default setting). Two credentials of different types must be attached to the same GraphQL node; the domain-restricted target credential must be the second (or non-first) credential in the attachment order, as only the first credential's allowed-domains policy is enforced. The attacker must also control or reach an endpoint outside the restricted domain list to receive the exfiltrated credential material. Exploitation is limited to the 1.x branch before 1.123.69 and the 2.x branch before 2.33.4 and 2.34.1. Organizations where workflow-authoring rights are tightly scoped to a small number of trusted users face substantially reduced realistic risk despite the network-accessible attack vector.

The CVSS 4.0 score of 5.1 reflects a moderate aggregate risk, anchored by AT:P (attack requirements present), which acknowledges that exploitation is conditional on a specific multi-credential expression-mode configuration that is not the default. The subsequent-system confidentiality rating of High (SC:H) is the most consequential signal: a successfully exfiltrated credential may grant the attacker privileges on external APIs or services far exceeding their n8n role, producing a risk disproportionate to the base score. No KEV listing exists, no POC has been identified, and no EPSS score was provided in the available data - active exploitation is therefore unconfirmed. The primary real-world limiting factor is the requirement for authenticated access with workflow-authoring rights, which narrows the exploitable population to trusted internal users or compromised accounts. This is a meaningful insider-threat and privilege-escalation-adjacent risk for organizations that grant broad workflow-authoring access, but is unlikely to be mass-exploited against external perimeters in its current form.

An authenticated n8n user with workflow-authoring rights creates or edits a workflow containing a GraphQL node, sets the Authentication parameter to expression mode, and attaches two credentials of different types - a domain-restricted credential belonging to a sensitive service and a second credential pointing to an attacker-controlled HTTPS endpoint. When the workflow executes, n8n enforces the allowed-domains policy of the first credential only and forwards the secret material of the second credential to the attacker's endpoint, completing exfiltration silently within the context of normal workflow activity. No public exploit code has been identified at time of analysis.