Executive brief
n8n is a workflow automation platform that allows users to connect and orchestrate applications and services. A vulnerability in the MCP (Model Context Protocol) create_workflow_from_code tool allows attackers with valid API credentials to bypass security checks and attach credentials from one project to workflows in another project. While the actual credential secrets are not exposed and cannot be used at runtime, this enables unauthorized persistence of cross-project credential references, potentially creating security misconfigurations.
Technical details
The vulnerability is an authorization bypass (CWE-639) in n8n's MCP create_workflow_from_code tool. The root cause is that when a node's authentication type is set to an expression rather than a literal string, the credential validator does not apply expression-awareness guards, treating the raw expression as the active type and thus bypassing the cross-project ownership validation check. Exploitation requires: (1) MCP to be enabled on the instance, (2) a valid MCP Bearer API key, and (3) knowledge of a target credential ID from another project. An attacker can persist unauthorized credential references across project boundaries; however, the runtime execution path still blocks the foreign credential from being used, so no credential secrets are exposed. The issue is patched in n8n versions 2.33.4 and 2.34.1 and later.
Affected products
- n8n n8n < 2.34.1, < 2.33.4
Timeline
- 2026-08-05: disclosed: GitHub Security Advisory GHSA-vfrj-582q-mvcp published
- 2026-08-20: patched: Patched in n8n versions 2.33.4 and 2.34.1