CVE-2026-77073 in n8n
Summary
by MITRE • 08/20/2026
n8n versions before 2.34.1 contain a credential validation bypass in the MCP create_workflow_from_code tool when authentication type is set to an expression. Attackers with a valid MCP Bearer API key and knowledge of a target credential ID can persist unauthorized cross-project credential references on workflows in different projects.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in n8n versions prior to 2.34.1 represents a critical authentication bypass within the Model Context Protocol implementation, specifically affecting the create_workflow_from_code tool. This flaw arises from an insufficient validation mechanism when the authentication type for a workflow node is configured using dynamic expressions rather than static values. In normal operation, n8n requires strict verification of credential IDs to ensure that workflows only reference credentials belonging to the authenticated user or project context. However, by leveraging expression-based configuration, attackers can circumvent these checks because the system fails to resolve and validate the actual credential identity before allowing the workflow definition to be persisted. This architectural oversight allows for a form of authorization bypass where the integrity of credential ownership is compromised during the code-to-workflow translation process.
The operational impact of this vulnerability is significant as it enables unauthorized cross-project credential references. An attacker who possesses a valid MCP Bearer API key and has knowledge or ability to guess a target credential ID can inject workflows into different projects that utilize credentials they do not own. This effectively allows the attacker to execute actions using elevated privileges associated with those external credentials, such as accessing sensitive data stores, sending emails on behalf of other users, or interacting with third-party APIs under false identities. The persistence of these unauthorized references means that even after initial detection, malicious workflows may continue to operate until manually removed, posing a sustained risk to organizational security posture and data confidentiality across multiple project boundaries within the n8n instance.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication, as it involves bypassing established authentication mechanisms through expression manipulation. It also relates closely to CWE-915 Improper Modification of Objects with Incorrectly Controlled Behavior Modifiers, given that the workflow object is modified in an unintended way by injecting unauthorized credential references. In terms of threat modeling and ATT&CK mapping, this behavior corresponds to Tactic TA0004 Privilege Escalation and Technique T1652 Impersonification, where the attacker assumes the identity of another user or service account. Additionally, it falls under lateral movement patterns as it allows access to resources across different project scopes that should remain isolated from one another.
Mitigation strategies must prioritize immediate upgrading to n8n version 2.34.1 or later, which addresses this validation bypass by enforcing stricter checks on credential IDs within expression contexts. Administrators should also implement strict input validation and sanitization for any workflow definitions received via the MCP interface, ensuring that all dynamic expressions are resolved and verified against authorized credential lists before persistence. Furthermore, adopting a principle of least privilege for API keys is essential to limit the blast radius if an attacker obtains valid credentials. Regular audits of workflow configurations across projects can help detect any residual unauthorized references introduced by older versions or unpatched instances, ensuring that only explicitly approved credential associations remain active within the automation environment.