CVE-2026-77081: n8n GraphQL node allowed-domains

CISO Take

A logic flaw in n8n's GraphQL node lets a workflow that mixes two different credential types under expression-mode authentication bypass the platform's allowed-domains guardrail: the node only enforces the domain restriction of the first attached credential while still sending authentication material from both, so a second, domain-restricted credential can be shipped to an attacker-controlled endpoint. This matters because n8n sits in the ai_agent category as a workflow orchestration layer that routinely wires together SaaS, database, and LLM API credentials, and 16 downstream packages depend on it, so any workflow-authoring account (not just an admin) becomes a viable insider or compromised-account exfiltration path. There is no CISA KEV listing, no published EPSS score, no public PoC, and no Nuclei template for this CVE, so opportunistic mass exploitation is unlikely today — but the package already carries 201 other CVEs and a mediocre 6.6/10 OpenSSF Scorecard, and this class of allowed-domains bypass is trivial for a malicious or careless workflow author to trigger once they know the trick. Patch to n8n 1.123.69, 2.33.4, or 2.34.1 as soon as maintenance windows allow, and in the interim audit workflows for GraphQL nodes with expression-mode authentication that reference more than one credential, restrict who can author or edit such workflows, and review outbound HTTP destinations for signs of credential leakage.

Sources:NVDGitHub Advisoryvulncheck.comOpenSSFATLAS

What is the risk?

Rated medium severity with no CVSS vector published and no EPSS/KEV signal, so near-term mass exploitation is unlikely. However, the bug requires only workflow-authoring privileges (not admin) to trigger, has a clear and repeatable exploitation path (attach two credential types, set expression-mode auth, point one endpoint outside the allowed domain), and yields real credential material with the leaked credential's original permissions — a high-value outcome for a low-privilege bar. Combined with n8n's broader risk posture (201 other CVEs in the package, OpenSSF Scorecard of 6.6/10, package risk score 69/100), this is a plausible insider-threat or compromised-low-privilege-account vector even without public exploit code.

How does the attack unfold?

Precondition: authenticated access

Attacker obtains or already holds a workflow-authoring account in a shared n8n instance, sufficient to create or edit GraphQL nodes.

AML.T0012

Malicious node configuration

Attacker configures a GraphQL node with Authentication set to expression mode and attaches two credentials of different types, one domain-restricted and one throwaway.

AML.T0098

Policy bypass and exfiltration

n8n enforces the allowed-domains policy only for the first credential while still attaching both credentials' auth material, letting the request reach an attacker-controlled endpoint.

AML.T0086

Credential reuse / impact

Attacker captures the leaked domain-restricted credential's material and replays it against the real service with its original permissions, achieving unauthorized data access.

AML.T0091

Precondition: authenticated access

Attacker obtains or already holds a workflow-authoring account in a shared n8n instance, sufficient to create or edit GraphQL nodes.

AML.T0012

Malicious node configuration

Attacker configures a GraphQL node with Authentication set to expression mode and attaches two credentials of different types, one domain-restricted and one throwaway.

AML.T0098

Policy bypass and exfiltration

n8n enforces the allowed-domains policy only for the first credential while still attaching both credentials' auth material, letting the request reach an attacker-controlled endpoint.

AML.T0086

Credential reuse / impact

Attacker captures the leaked domain-restricted credential's material and replays it against the real service with its original permissions, achieving unauthorized data access.

AML.T0091

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
n8n	npm	—	No patch
209.2KOpenSSF 7.116 dependentsPushed yesterday44% patched~19d to patchFull package profile →

Do you use n8n? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 32% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What should I do?

1 step

Upgrade to n8n 1.123.69 (1.x line), 2.33.4, or 2.34.1 (2.x lines) immediately. Until patched: audit existing workflows for GraphQL nodes using expression-mode Authentication, especially any with more than one credential referenced; restrict workflow-authoring/editing permissions for users who don't need them; review recent workflow edits and execution logs for GraphQL node requests to unexpected external domains; rotate any credentials that were used in GraphQL nodes with expression-mode auth as a precaution. Detection: alert on outbound requests from n8n's execution environment to domains not on the organization's expected allowlist, and monitor for new/modified workflows touching GraphQL nodes.

What does CISA's SSVC say?

DecisionTrack

Exploitationnone

AutomatableNo

Technical Impactpartial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Auth BypassData LeakageAgentPluginAML.T0086- Exfiltration via AI Agent Tool Invocation AML.T0091- Use Alternate Authentication Material AML.T0098- AI Agent Tool Credential Harvesting

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

NIST AI RMF

GOVERN 6.1-Policies and procedures for third-party AI system components and resources

OWASP LLM Top 10

LLM02-Sensitive Information DisclosureLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-77081?

A logic flaw in n8n's GraphQL node lets a workflow that mixes two different credential types under expression-mode authentication bypass the platform's allowed-domains guardrail: the node only enforces the domain restriction of the first attached credential while still sending authentication material from both, so a second, domain-restricted credential can be shipped to an attacker-controlled endpoint. This matters because n8n sits in the ai_agent category as a workflow orchestration layer that routinely wires together SaaS, database, and LLM API credentials, and 16 downstream packages depend on it, so any workflow-authoring account (not just an admin) becomes a viable insider or compromised-account exfiltration path. There is no CISA KEV listing, no published EPSS score, no public PoC, and no Nuclei template for this CVE, so opportunistic mass exploitation is unlikely today — but the package already carries 201 other CVEs and a mediocre 6.6/10 OpenSSF Scorecard, and this class of allowed-domains bypass is trivial for a malicious or careless workflow author to trigger once they know the trick. Patch to n8n 1.123.69, 2.33.4, or 2.34.1 as soon as maintenance windows allow, and in the interim audit workflows for GraphQL nodes with expression-mode authentication that reference more than one credential, restrict who can author or edit such workflows, and review outbound HTTP destinations for signs of credential leakage.

Is CVE-2026-77081 actively exploited?

No confirmed active exploitation of CVE-2026-77081 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-77081?

Upgrade to n8n 1.123.69 (1.x line), 2.33.4, or 2.34.1 (2.x lines) immediately. Until patched: audit existing workflows for GraphQL nodes using expression-mode Authentication, especially any with more than one credential referenced; restrict workflow-authoring/editing permissions for users who don't need them; review recent workflow edits and execution logs for GraphQL node requests to unexpected external domains; rotate any credentials that were used in GraphQL nodes with expression-mode auth as a precaution. Detection: alert on outbound requests from n8n's execution environment to domains not on the organization's expected allowlist, and monitor for new/modified workflows touching GraphQL nodes.

What systems are affected by CVE-2026-77081?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, workflow orchestration pipelines, plugin/tool integrations.

What is the CVSS score for CVE-2026-77081?

No CVSS score has been assigned yet.

What is the AI security impact?

Affected AI Architectures

agent frameworksworkflow orchestration pipelinesplugin/tool integrations

MITRE ATLAS Techniques

AML.T0086Exfiltration via AI Agent Tool Invocation

AML.T0091Use Alternate Authentication Material

AML.T0098AI Agent Tool Credential Harvesting

Compliance Controls Affected

EU AI Act: Article 15

NIST AI RMF: GOVERN 6.1

OWASP LLM Top 10: LLM02, LLM06

What are the technical details?

Original Advisory

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are attached, the node enforces the allowed-domains policy of only the first credential while still attaching material from both. An authenticated user with workflow-authoring rights can thereby send a domain-restricted credential to an attacker-controlled endpoint, exfiltrating it with the leaked credential's permissions.

Exploitation Scenario

An employee or contractor with workflow-authoring rights in a shared n8n instance builds a GraphQL node, sets its Authentication parameter to expression mode, and attaches two credentials: a low-value credential of their own plus a high-value, domain-restricted credential (e.g., an internal API key scoped to `internal-api.company.com`) that other team members' workflows also use. Because the node only enforces the allowed-domains policy of the first credential, the attacker points the actual GraphQL request at an attacker-controlled endpoint; n8n still attaches authentication material from both credentials to that outbound call. The attacker's endpoint captures the second credential's material and replays it directly against the real internal API with its original permissions, achieving unauthorized data access or lateral movement without ever needing to compromise the credential's original owner.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.