CVE-2026-77076 n8n-io CVE debrief

Who should care

Teams using n8n for workflow automation, especially those handling sensitive data or credentials, should be aware of this vulnerability. Security teams and administrators responsible for n8n installations and data security are primarily concerned.

Technical summary

The n8n workflow automation tool has an information disclosure vulnerability in its GraphQL node. When a GraphQL request fails at the connection level, the node re-throws the underlying HTTP client error without modification. This error can contain decrypted credential secrets that are persisted in the execution engine's stored run data. Any authenticated user able to read the resulting execution can retrieve the decrypted credential secret.

Defensive priority

Authenticated users with access to execution data may be able to retrieve decrypted credential secrets, posing a high risk to confidentiality.

Recommended defensive actions

• Inventory n8n installations to identify potentially affected versions.
• Restrict access to execution data for authenticated users.
• Monitor for suspicious GraphQL requests and error handling.
• Apply vendor patches or updates when available.
• Consider compensating controls like encryption for sensitive data.

Evidence notes

The CVE-2026-77076 record indicates that n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain an information disclosure vulnerability in the GraphQL node. Official records show that a GraphQL request failure at the connection level leads to the re-throwing of the underlying HTTP client error, which includes decrypted credential secrets. However, further details on affected configurations and vendor remediation efforts are limited in the provided source corpus.

Official resources