Sign in
Deutsch English Español Polski
High

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

  • Disclosed: 22.07.2026
  • Updated: 11.10.2026 10:22

Impact

The AI Agents feature did not enforce the "Allowed HTTP Request Domains" restriction configured on credentials. As a result, a member-level user who had been granted use-only access to a shared credential could cause its secret to be sent to an external server they control, by pointing an MCP tool at an arbitrary URL and running the agent.

This issue only affects instances where the AI Agents module is enabled via N8N_ENABLED_MODULES=agents and at least one credential with domain restrictions has been shared with a member-level user.

Patches

The issue has been fixed in n8n version 2.28.1 and 2.27.4. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Disable the AI Agents module by removing agents from the N8N_ENABLED_MODULES environment variable.
  • Restrict credential sharing to fully trusted users only.
  • Audit credentials with domain restrictions for unexpected sharing relationships.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package n8n >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4

References

CVSS score -
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Weakness (CWE)
CWE-693
Platform
npm
Package
n8n
Disclosed
22.07.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-h44j-f5r5-ph73 - CC BY 4.0

Vulnerability history: n8n

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (156) in the archive
Total entries
156
First → latest
05.2023 09.2026
Without a fix
1
Exploited in attacks
1

Severity breakdown

  • Critical 24
  • High 58
  • Medium 74

Disclosures per year

Severity:
  1. n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
    High CVE-2026-86083 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  2. n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
    High CVE-2026-86082 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  3. n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
    High CVE-2026-86081 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  4. n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
    High CVE-2026-86075 >= 2.38.0, < 2.38.2, < 2.37.7 2.38.2, 2.37.7
  5. n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
    High CVE-2026-86076 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  6. n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
    High CVE-2026-72749 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  7. n8n: Edit Image Node Format Injection Allows Arbitrary File Write
    High CVE-2026-72762 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  8. n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
    High CVE-2026-72763 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  9. n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
    High CVE-2026-72774 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  10. n8n: Expression sandbox escape via arrow-function bodies enabling command execution
    High CVE-2026-72765 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  11. n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
    High CVE-2026-72766 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  12. n8n: Authenticated code execution in the n8n Git node
    High CVE-2026-72767 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  13. n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
    High CVE-2026-72770 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  14. n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes
    High CVE-2026-72771 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  15. n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
    High CVE-2026-72772 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  16. n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
    High CVE-2026-65016 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  17. n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
    High CVE-2026-65591 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  18. n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs
    High CVE-2026-65595 >= 2.30.0, < 2.30.1, < 2.29.8 2.30.1, 2.29.8
  19. n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
    High CVE-2026-59208 >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4
  20. n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector this entry
    High CVE-2026-59207 >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4
Show more (20) Showing 20 of 82

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.