CVE-2026-77081 in n8n
Summary
by MITRE • 08/20/2026
n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are attached, the node enforces the allowed-domains policy of only the first credential while still attaching material from both. An authenticated user with workflow-authoring rights can thereby send a domain-restricted credential to an attacker-controlled endpoint, exfiltrating it with the leaked credential's permissions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/20/2026
The vulnerability identified in n8n versions prior to 1.123.69, as well as specific early releases of the 2.x series including those before 2.33.4 and 2.34.1, represents a critical security flaw within the GraphQL node implementation. This issue stems from an improper restriction of allowed domains during credential handling when the Authentication parameter is configured in expression mode. In this configuration, the application fails to correctly isolate or validate domain restrictions for each individual credential attached to the workflow step. Instead of enforcing strict per-credential validation against a whitelist of permitted destinations, the system treats all authentication-gated credential selectors as active and applies only the allowed-domains policy associated with the first credential in the list. This logic error creates a scenario where subsequent credentials are processed without their own specific domain restrictions being enforced, effectively bypassing security controls designed to limit data exfiltration paths.
From a technical perspective, this flaw allows for an unauthorized lateral movement of sensitive authentication material across different service boundaries. When multiple credentials of varying types are attached to the same node, the system attaches the actual credential payloads from all sources but only validates the destination domain against the policy defined by the first credential. Consequently, if the first credential permits access to a specific set of domains that includes an attacker-controlled endpoint, any subsequent credentials—regardless of their own restrictive policies—are also transmitted to that same unauthorized location. This behavior fundamentally undermines the principle of least privilege and compartmentalization, as it allows high-privilege or sensitive credentials intended for internal services to be exposed to external, untrusted entities through a single misconfigured workflow step.
The operational impact of this vulnerability is severe, particularly in environments where n8n is used to orchestrate integrations between various cloud services and on-premise systems. An authenticated user with workflow-authoring rights can exploit this flaw by constructing a malicious workflow that includes both a legitimate credential bound for an internal service and another sensitive credential intended for restricted use. By configuring the authentication mode to expression, the attacker ensures that the domain check is bypassed for all but the first credential. The result is the exfiltration of credentials with their full permissions to an endpoint controlled by the attacker. This can lead to unauthorized access to downstream systems, data theft, and potential compromise of broader organizational infrastructure depending on the privileges held by the leaked credentials.
This vulnerability aligns closely with CWE-20 Improper Input Validation, as the application fails to properly validate input parameters related to domain restrictions for all attached credentials. It also maps to ATT&CK technique T1537, which involves Domain Fronting or similar techniques where traffic is directed through allowed domains to mask malicious activity, and potentially T1048 Exfiltration Over Alternative Protocol if the GraphQL endpoint itself is used as a channel. To mitigate this risk, organizations must immediately upgrade n8n to version 1.123.69 or later for the legacy branch, or versions 2.33.4 and 2.34.1 and above for the current release line. Additionally, administrators should enforce strict role-based access controls to limit who can create or modify workflows containing credential nodes. Regular auditing of workflow configurations and monitoring for unusual outbound traffic patterns from n8n instances can further help in detecting potential exploitation attempts before significant damage occurs.