Which versions of n8n are affected by EUVD-2026-56100?

n8n's HTTP Request node contains an authorization bypass flaw allowing authenticated users with workflow edit permissions to silently exfiltrate credentials belonging to other users.. A patch is available.

How to fix or mitigate EUVD-2026-56100?

Within 24 hours, enumerate all n8n deployments and identify current versions to locate affected instances. Within 7 days, upgrade to patched versions-1.123.67 for 1.x branch, or 2.31.5 and 2.32.1 for 2.x branch-and audit workflow sharing permissions to restrict edit access to designated administrators only. Within 30 days, review credential access logs, investigate workflow modifications during the vulnerability window, and conduct a full access review of all shared workflows to detect unauthorized credential use.

n8n EUVD-2026-56100

Q: What is the CVSS score of EUVD-2026-56100?

EUVD-2026-56100 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-72774 HIGH

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-08-11 VulnCheck

GHSA-r3ww-gmwx-48xw

Authentication Bypass N8n N8N Io

7.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.2 HIGH

Network vector with low privileges (PR:L); AC:H reflects the AT:P precondition (credential ID must be known); scope changes (S:C) because stolen credentials compromise downstream external systems; no availability impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 11, 2026 - 13:17 EUVD

Source Code Evidence Fetched

Aug 11, 2026 - 12:55 vuln.today

Analysis Generated

Aug 11, 2026 - 12:55 vuln.today

CVE Published

Aug 11, 2026 - 12:17 cve.org

HIGH 7.1

DescriptionCVE.org

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier.

AnalysisAI

Credential authorization bypass in n8n's HTTP Request node allows an authenticated member with edit access to a shared workflow to silently exfiltrate or use another user's credential by setting the credential type field via a dynamic expression. The pre-execution permission check evaluates the unresolved expression string rather than its runtime-resolved value, causing the ownership check to be skipped entirely while the actual credential is loaded at execution time. Versions 1.123.67, 2.31.5, and 2.32.1 contain the fix; no public exploit has been identified at time of analysis.

Technical ContextAI

n8n is an open-source workflow automation platform distributed as an npm package (cpe:2.3:a:n8n-io:n8n). The HTTP Request node supports credential types that can be specified either statically or through n8n's expression engine, which resolves values at workflow execution time. The root cause is CWE-639 (Authorization Bypass Through User-Controlled Key): the pre-execution authorization routine validates that the requesting user owns or is permitted to use the referenced credential by checking the credential type field - but when that field contains an expression (e.g., an n8n template literal), the check compares the raw, unresolved expression string rather than the resolved credential type. This mismatch causes the ownership validation to produce a false-positive result, and the platform then loads the actual target credential - identified by a user-supplied credential ID embedded in the workflow - at execution time without re-checking authorization. The vulnerability is isolated to the interaction between n8n's expression evaluation pipeline and its pre-execution credential permission guard in the HTTP Request node.

RemediationAI

The primary remediation is to upgrade n8n to version 1.123.67 (for 1.x deployments), 2.31.5 (for 2.x deployments on the pre-2.32.0 branch), or 2.32.1 (for 2.32.x deployments), as confirmed by the vendor advisory GHSA-6qc9-mqvw-jg7x and the upstream patch commit at https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f. If immediate upgrade is not feasible, the vendor recommends three partial mitigations with acknowledged limitations. First, restrict n8n instance access to fully trusted users only - this eliminates the insider-threat vector entirely but limits collaborative use of the platform. Second, exclude the HTTP Request node by adding n8n-nodes-base.httpRequest to the NODES_EXCLUDE environment variable - this fully removes the attack surface but disables HTTP Request node functionality for all users and workflows. Third, audit credential sharing and workflow access to reduce the likelihood that untrusted members can discover credential identifiers, since exploitation requires knowing a target credential's ID - this measure reduces exposure but does not eliminate it. The vendor notes that these workarounds do not fully remediate the vulnerability and are suitable only as short-term interim controls.