CVE-2026-72774 n8n-io CVE debrief

Who should care

Defenders responsible for n8n deployments, particularly those with shared workflows and sensitive credentials, should assess exposure and prioritize remediation. They should verify and upgrade to a fixed version, restrict access to sensitive workflows, and monitor for suspicious credential usage. Additionally, they should review compensating controls for exposed systems and track exceptions and retest remediated assets.

Why it matters

CVE-2026-72774 is a high-severity vulnerability in n8n that allows an authenticated user to bypass credential authorization, potentially leading to unauthorized access to sensitive credentials. Defenders should prioritize verifying and upgrading to a fixed version, restricting access to sensitive workflows, and monitoring for suspicious credential usage.

• Potential unauthorized access to sensitive credentials
• Possible credential exfiltration via HTTP Request node
• Required verification of n8n version and deployment exposure
• Necessity for restrictive access controls on workflows and credentials

Technical summary

The vulnerability exists in the HTTP Request node of n8n, allowing an authenticated user with edit access to a shared workflow to reference another user's credential via an expression. The pre-execution permission check compares the unresolved expression instead of the resolved credential type, skipping the ownership check and loading the credential at execution time. This allows the member to use or exfiltrate a credential they were not granted. Exploitation requires knowing the target credential's identifier. The issue affects n8n versions before 1.123.67, 2.31.5, and 2.32.1, and defenders should prioritize verifying and upgrading to a fixed version.

Defensive priority

Defenders should prioritize verifying and upgrading to a fixed version of n8n, restricting access to sensitive workflows, and monitoring for suspicious credential usage.

Recommended defensive actions

• Verify and upgrade to a fixed version of n8n (1.123.67, 2.31.5, or 2.32.1)
• Restrict access to sensitive workflows and credentials
• Monitor for suspicious credential usage and workflow modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected versions. However, the exact scope of affected deployments and potential impact require further verification.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.