CVE-2026-72771 in n8n
Summary
by MITRE • 08/11/2026
n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are configured. Low-privileged workflow editors with use-only access to shared credentials can redirect requests to attacker-controlled hosts and exfiltrate credential secrets for reuse against underlying services.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability described affects n8n versions prior to 2.32.1 and represents a critical authorization bypass in AI and LLM nodes that undermines the platform's security controls. This flaw exists within the HTTP request handling mechanism where the system fails to properly validate user-supplied base or endpoint URLs against the configured Allowed HTTP Request Domains allowlist. The vulnerability specifically impacts multiple artificial intelligence and large language model nodes, which are commonly used in workflow automation for connecting to external AI services such as OpenAI, Anthropic, and other third-party LLM providers.
The technical implementation flaw stems from insufficient input validation and access control enforcement within the node configuration processing logic. When low-privileged users with use-only access to shared credentials configure these AI nodes, they can specify arbitrary base or endpoint URLs that bypass the intended security boundaries. This occurs because the system does not properly enforce the allowlist restrictions during runtime execution of these nodes, allowing malicious actors to redirect requests from legitimate service endpoints to attacker-controlled hosts. The vulnerability is particularly dangerous because it leverages existing credential access patterns without requiring additional privilege escalation.
The operational impact of this vulnerability is severe and multifaceted across multiple security domains. Attackers can exploit this flaw to perform credential exfiltration by redirecting requests through controlled endpoints, potentially capturing authentication tokens, API keys, or other sensitive credentials stored in shared credential repositories. This capability enables attackers to reuse stolen credentials against underlying services, effectively providing persistent access to AI platforms and their associated resources. The vulnerability affects both internal and external threat actors who may leverage this weakness for reconnaissance, data exfiltration, or lateral movement within the n8n ecosystem.
This vulnerability aligns with CWE-285 (Improper Authorization) and CWE-942 (Overly Permissive Allowlist) categories, representing a failure in access control enforcement mechanisms. The flaw also maps to several ATT&CK techniques including T1566 (Phishing), T1071.004 (Application Layer Protocol: DNS), and T1528 (Steal Application Access Token), as attackers can leverage the compromised nodes to redirect traffic and harvest credentials for further exploitation. Organizations using affected n8n versions face increased risk of unauthorized access to AI services, potential data breaches, and compromise of sensitive information processed through automated workflows.
Mitigation strategies should include immediate upgrade to n8n version 2.32.1 or later where the vulnerability has been addressed through proper input validation and enforcement of allowlist restrictions. Additional protective measures include implementing network-level firewalls to restrict outbound connections from n8n instances, monitoring for unusual HTTP request patterns, and conducting thorough credential rotation for all shared credentials used in AI workflow nodes. Security teams should also consider implementing runtime monitoring solutions that can detect anomalous behavior in automated workflows and establish strict access controls for credential management within the platform.