CVE-2026-72774 in n8n
Summary
by MITRE • 08/11/2026
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credential type via an expression. Because the pre-execution permission check compares the unresolved expression instead of the resolved credential type, the ownership check is skipped and the credential is loaded at execution time, allowing the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/11/2026
The vulnerability in n8n versions prior to 1.123.67, 2.31.5, and 2.32.1 represents a critical authorization bypass affecting the HTTP Request node functionality. This flaw occurs within the permission validation mechanism that governs credential access within shared workflows. The core issue stems from a fundamental design weakness in how the system handles expression-based credential references during workflow execution phases.
The technical implementation of this vulnerability manifests through a specific flaw in the pre-execution authorization check process. When an authenticated user with edit permissions attempts to configure an HTTP Request node, they can specify a credential type using an expression rather than a direct selection. The system's permission validation logic incorrectly evaluates the unresolved expression rather than resolving it to determine the actual credential type being referenced. This mismatch between evaluation timing and authorization scope creates a window where unauthorized credential usage becomes possible.
This vulnerability operates under the framework of CWE-285, which addresses improper authorization scenarios within software systems, specifically targeting cases where access controls fail to properly validate user permissions against dynamic resource references. The flaw aligns with ATT&CK technique T1566, which encompasses credential access through exploitation of application vulnerabilities that allow unauthorized data retrieval or manipulation.
The operational impact of this vulnerability is significant for organizations utilizing n8n's workflow automation capabilities. An authenticated attacker with edit rights to a shared workflow can effectively bypass the intended permission model by leveraging expression-based credential references. The attack requires knowledge of the target credential identifier, but once obtained, allows the unauthorized user to access credentials belonging to other users within the same system. This creates potential for data exfiltration, service disruption, or further lateral movement within the automated workflow environment.
The vulnerability demonstrates a classic case of temporal logic failure in authorization systems where checks occur at different execution phases with mismatched evaluation contexts. The pre-execution check validates against an expression that resolves to a credential type, but this validation does not account for the actual credential being accessed during runtime. This discrepancy allows attackers to bypass normal access controls by exploiting the timing gap between policy enforcement and actual resource access.
Mitigation strategies should focus on implementing proper credential resolution validation at the pre-execution phase, ensuring that authorization checks occur against resolved credential identifiers rather than unresolved expressions. Organizations should immediately upgrade to the patched versions of n8n to address this vulnerability. Additionally, administrators should implement strict monitoring of workflow modifications and credential usage patterns to detect potential exploitation attempts. The fix requires updating the permission validation logic to properly resolve expressions before performing credential ownership checks, thereby ensuring that authorization decisions are made against actual resource identifiers rather than their expression representations.
Security teams should also consider implementing additional controls such as credential access logging and automated alerting for unusual credential usage patterns within shared workflow environments. Regular security assessments of workflow automation platforms should include evaluation of authorization mechanisms to identify similar temporal logic vulnerabilities that might exist in other components of the system architecture.