Executive brief
n8n is a workflow automation platform that allows users to build and execute automated tasks integrating multiple services. An authenticated user can exploit a flaw in how the HTTP Request node validates domains to send requests with stored credentials to unintended domains, risking exposure of sensitive authentication tokens. This only affects deployments where credentials are configured with wildcard domain patterns (e.g., *.example.com).
Technical details
The vulnerability exists in the HTTP Request node's credential domain validation logic, which fails to properly validate domain restrictions when wildcard patterns are configured in the "Allowed domains" setting. An authenticated attacker with workflow creation or modification permissions can craft requests that bypass the allowlist and send credentials to unintended domains, potentially exfiltrating sensitive credentials. The attack requires authentication and does not require user interaction beyond crafting a malicious workflow. The flaw is remedied in version 1.121.0; affected versions prior to 1.121.0 should upgrade immediately. Workarounds include replacing wildcard patterns with explicit domain listings and restricting workflow modification permissions.
Affected products
- n8n n8n before 1.121.0
Timeline
- 2026-02-04: disclosed: GitHub Security Advisory GHSA-2xcx-75h9-vr9h published
- 2026-02-04: patched: Fix released in n8n version 1.121.0