CVE-2026-77081 n8n-io CVE debrief

Who should care

Teams using n8n for workflow automation, especially those with workflow-authoring rights, should review and restrict access to prevent potential credential exfiltration. Verify n8n version and apply vendor remediation if available. Restrict workflow-authoring rights to minimize the attack surface. Inventory and monitor n8n installations for updates and ensure allowed-domains policy enforcement. Security teams should prioritize patching and compensating controls for exposed systems while remediation is scheduled and verified. Monitoring and detection capabilities should be reviewed to identify potential exploitation attempts. Asset inventory and vulnerability management processes should be updated to reflect the severity of this vulnerability. Change management and rollback procedures should be assessed to ensure timely and effective remediation. Source tracking and incident response plans should be reviewed to ensure readiness in case of exploitation. Compensating controls, such as additional authentication or access controls, should be considered for exposed systems. The impact of this vulnerability on the organization should be carefully assessed, and remediation efforts should be prioritized accordingly. The allowed-domains bypass vulnerability in n8n's GraphQL node has significant implications for the security of workflow automation environments, and affected teams should take immediate action to mitigate the risk. The CVE record indicates that the vulnerability has not been modified since its publication on 2026-08-20T12:16:39.590Z. Therefore, it is essential to verify the current version of n8n and apply vendor remediation if available. The CVE description highlights the importance of restricting workflow-authoring rights and inventorying and monitoring n8n installations for updates. By taking these steps, teams can minimize the risk of credential exfiltration and ensure the security of their workflow automation environments. The vulnerability's severity and potential impact emphasize the need for prompt action and thorough remediation efforts. Affected teams should review the CVE record and apply vendor guidance to address the allowed-domains bypass issue

Technical summary

The n8n workflow automation tool contains an allowed-domains bypass vulnerability in its GraphQL node. When the node's Authentication parameter is set to expression mode, an authenticated user with workflow-authoring rights can exploit this vulnerability to send a domain-restricted credential to an attacker-controlled endpoint, potentially exfiltrating it with the leaked credential's permissions. This issue affects n8n versions before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1. Review and restrict workflow-authoring rights. Inventory and monitor n8n installations for updates.

Defensive priority

Authenticated users with workflow-authoring rights could potentially exploit this vulnerability to exfiltrate credentials. Review and restrict workflow-authoring rights. Inventory and monitor n8n installations for updates.

Recommended defensive actions

• Inventory n8n installations for version checks
• Restrict workflow-authoring rights
• Monitor for updates and apply vendor remediation
• Verify allowed-domains policy enforcement
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE description indicates that n8n versions before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. An authenticated user with workflow-authoring rights can exploit this vulnerability to send a domain-restricted credential to an attacker-controlled endpoint. Verify n8n version and apply vendor remediation if available.

Official resources