CVE-2026-59207: n8n protection mechanism failure in AI Agents MCP connector

Executive brief

A vulnerability in n8n's AI Agents feature allows users with limited access to bypass security restrictions intended to keep sensitive credentials safe. An attacker could redirect secret credentials to a server they control, potentially leading to the theft of API keys or other sensitive authentication data. This issue affects organizations using the AI Agents module with shared credentials.

Technical details

A protection mechanism failure (CWE-693) exists in n8n where the AI Agents feature does not enforce the 'Allowed HTTP Request Domains' restriction on credentials. A member-level user with 'use-only' access to a shared credential can exploit this by configuring a Model Context Protocol (MCP) tool to point to an arbitrary, attacker-controlled URL. When the agent is executed, the credential secrets are transmitted to the unauthorized domain. This vulnerability requires the AI Agents module to be enabled and at least one restricted credential to be shared. The issue is resolved in versions 2.28.1 and 2.27.4.

Affected products

• n8n-io n8n >= 2.28.0, < 2.28.1; < 2.27.4

Timeline

• 2026-06-24: disclosed
• 2026-07-09: advisory: NVD publication
• 2026-07-22: patched: GitHub Advisory published/updated

References

• https://api.github.com/users/trap-bytes
• https://github.com/trap-bytes
• https://api.github.com/users/trap-bytes/gists%7B/gist_id%7D
• https://api.github.com/users/trap-bytes/repos
• https://avatars.githubusercontent.com/u/80951137?v=4
• https://api.github.com/users/trap-bytes/events%7B/privacy%7D