Executive brief
n8n is a workflow automation platform that allows users to create and share credentials for connecting to external services. The "Allowed HTTP Request Domains" feature restricts where shared credentials can send sensitive authentication secrets, protecting them from misuse by lower-privileged users. A vulnerability in AI and LLM nodes allows a workflow editor with view-only access to a shared credential to bypass these domain restrictions by specifying a custom endpoint URL, potentially exfiltrating the credential's secret to an attacker-controlled server for reuse against the underlying service.
Technical details
This vulnerability is an authorization bypass (CWE-863) in n8n's credential protection mechanism. Multiple AI/LLM workflow nodes fail to enforce the "Allowed HTTP Request Domains" allowlist when a user provides a custom base URL or endpoint URL parameter. An attacker with workflow editor privileges and use-only access to a shared credential can redirect API calls to an attacker-controlled host, causing the credential's secret to be transmitted in plaintext. The vulnerability requires low privilege level (workflow editor role) and network-level access but no user interaction. Fixed versions 2.31.5 and 2.32.1 and later properly validate domain restrictions regardless of user-supplied URL parameters.
Affected products
- n8n n8n below 2.31.5 and below 2.32.1
Timeline
- 2026-07-22: disclosed
- 2026-07-22: patched: Fixed in versions 2.31.5 and 2.32.1