Zaloguj się
Deutsch English Español Polski
Wysoka

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

  • Ujawniono: 22.07.2026
  • Aktualizacja: 11.10.2026 10:22

Impact

The AI Agents feature did not enforce the "Allowed HTTP Request Domains" restriction configured on credentials. As a result, a member-level user who had been granted use-only access to a shared credential could cause its secret to be sent to an external server they control, by pointing an MCP tool at an arbitrary URL and running the agent.

This issue only affects instances where the AI Agents module is enabled via N8N_ENABLED_MODULES=agents and at least one credential with domain restrictions has been shared with a member-level user.

Patches

The issue has been fixed in n8n version 2.28.1 and 2.27.4. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

  • Disable the AI Agents module by removing agents from the N8N_ENABLED_MODULES environment variable.
  • Restrict credential sharing to fully trusted users only.
  • Audit credentials with domain restrictions for unexpected sharing relationships.

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

PlatformaPaczkaPodatne wersjePoprawka w wersji
Paczka npm n8n >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4

Odnośniki

Ocena CVSS -
Wektor CVSS
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Słabość (CWE)
CWE-693
Platforma
npm
Paczka
n8n
Ujawniono
22.07.2026
Aktualizacja
11.10.2026 10:22

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-h44j-f5r5-ph73 - CC BY 4.0

Historia podatności: n8n

Wszystkie opisane podatności tej paczki (Paczka npm), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (156) w archiwum
Wszystkich wpisów
156
Pierwsza → ostatnia
05.2023 09.2026
Bez poprawki
1
Wykorzystywana w atakach
1

Rozkład istotności

  • Krytyczna 24
  • Wysoka 58
  • Średnia 74

Ujawnienia w latach

Istotność:
  1. n8n: Expression Sandbox Escape via Shared Builtin Tampering and Code-Printer Injection Leads to Code Execution
    Wysoka CVE-2026-86083 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  2. n8n: Domain-Restriction Bypass via Unguarded Model-Search Endpoint in OpenAI Chat Model Node
    Wysoka CVE-2026-86082 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  3. n8n: Regular Expression Denial of Service in the Default Blocked-File-Pattern Match via a Git Node Clone Path
    Wysoka CVE-2026-86081 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  4. n8n: Unauthenticated Persistent Storage Exhaustion via OAuth Dynamic Client Registration Endpoint
    Wysoka CVE-2026-86075 >= 2.38.0, < 2.38.2, < 2.37.7 2.38.2, 2.37.7
  5. n8n: Expression Sandbox Escape via Class-Field Sanitizer Rebinding Can Lead to Code Execution
    Wysoka CVE-2026-86076 < 1.123.76, >= 2.38.0, < 2.38.2, >= 2.0.0, < 2.37.7 1.123.76, 2.38.2, 2.37.7
  6. n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service
    Wysoka CVE-2026-72749 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  7. n8n: Edit Image Node Format Injection Allows Arbitrary File Write
    Wysoka CVE-2026-72762 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  8. n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON
    Wysoka CVE-2026-72763 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  9. n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`
    Wysoka CVE-2026-72774 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  10. n8n: Expression sandbox escape via arrow-function bodies enabling command execution
    Wysoka CVE-2026-72765 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  11. n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion
    Wysoka CVE-2026-72766 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  12. n8n: Authenticated code execution in the n8n Git node
    Wysoka CVE-2026-72767 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  13. n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction
    Wysoka CVE-2026-72770 < 1.123.67, >= 2.32.0, < 2.32.1, >= 2.0.0-rc.0, < 2.31.5 1.123.67, 2.32.1, 2.31.5
  14. n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes
    Wysoka CVE-2026-72771 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  15. n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login
    Wysoka CVE-2026-72772 >= 2.32.0, < 2.32.1, < 2.31.5 2.32.1, 2.31.5
  16. n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner
    Wysoka CVE-2026-65016 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  17. n8n: Legacy Expression Evaluator Sanitizer Bypass Leads to Authenticated Code Execution
    Wysoka CVE-2026-65591 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  18. n8n: Privilege Escalation and Code Execution via Full Public API Key Scope Assignment to Token Exchange JWTs
    Wysoka CVE-2026-65595 >= 2.30.0, < 2.30.1, < 2.29.8 2.30.1, 2.29.8
  19. n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution
    Wysoka CVE-2026-59208 >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4
  20. n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector ten wpis
    Wysoka CVE-2026-59207 >= 2.28.0, < 2.28.1, < 2.27.4 2.28.1, 2.27.4
  21. n8n: Prototype Pollution via Workflow Credentials Leads to Unauthenticated User and Project Enumeration
    Wysoka CVE-2026-59206 < 1.123.61, >= 2.28.0, < 2.28.1, >= 2.0.0-rc.0, < 2.27.4 1.123.61, 2.28.1, 2.27.4
  22. n8n: Shared Credential Header Leak via HTTP Request Pagination Expression
    Wysoka CVE-2026-59209 < 1.123.61, >= 2.28.0, < 2.28.1, >= 2.0.0-rc.0, < 2.27.4 1.123.61, 2.28.1, 2.27.4
  23. n8n: Stored DOM XSS via Resource Locator `cachedResultUrl`
    Wysoka CVE-2026-65592 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  24. n8n: DOM-Based XSS via Unsandboxed iframe srcdoc in HTML Preview
    Wysoka CVE-2026-65597 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  25. n8n: Race Condition in Git Clone Node Allows Authenticated Users to Achieve Remote Code Execution
    Wysoka CVE-2026-65598 < 1.123.64, >= 2.30.0, < 2.30.1, >= 2.0.0-rc.0, < 2.29.8 1.123.64, 2.30.1, 2.29.8
  26. n8n: AI Agents Project Viewer Privilege Escalation via run_node_tool
    Wysoka CVE-2026-65015 >= 2.30.0, < 2.30.1, < 2.29.8 2.30.1, 2.29.8
  27. n8n: SecurityScorecard Node Leaks API Token to User-Controlled Host
    Wysoka · 7.7 CVE-2026-54304 < 1.123.55, >= 2.26.0, < 2.26.1, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.1, 2.25.7
  28. n8n: MCP Browser HTTP Transport Exposes Unauthenticated Browser-Control Sessions
    Wysoka · 10.0 CVE-2026-54309 >= 2.26.0, < 2.26.2, < 2.25.7 2.26.2, 2.25.7
  29. n8n: Cross-Tenant Credential Takeover via Dynamic Credentials EE Endpoints
    Wysoka · 9.9 CVE-2026-54305 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  30. n8n: Credential Exfiltration via Permission Bypass
    Wysoka · 9.6 CVE-2026-54307 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  31. n8n: Stored XSS in Chat Trigger Node
    Wysoka · 7.6 CVE-2026-54302 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  32. n8n: Microsoft SQL Node Prototype Pollution
    Wysoka · 8.5 CVE-2026-54312 < 2.24.0 2.24.0
  33. n8n: Same-Origin XSS in Respond to Webhook Node
    Wysoka · 7.6 CVE-2026-54301 < 1.123.55, >= 2.26.0, < 2.26.2, >= 2.0.0-rc.0, < 2.25.7 1.123.55, 2.26.2, 2.25.7
  34. n8n: Python sandbox escape
    Wysoka · 8.5 CVE-2026-49444 < 1.123.48, >= 2.22.0, < 2.22.4, >= 2.0.0-rc.0, < 2.21.8 1.123.48, 2.22.4, 2.21.8
  35. n8n Has a Cross-user Authorization Bypass in Dynamic Credential OAuth Endpoints
    Wysoka · 8.1 CVE-2026-45732 < 1.123.43, >= 2.21.0, < 2.21.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.21.1, 2.20.7
  36. n8n Has a Source Control Pull SQL Injection
    Wysoka · 9.0 CVE-2026-44792 < 1.123.43, >= 2.21.0, < 2.21.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.21.1, 2.20.7
  37. n8n Has an XML Node Prototype Pollution Patch Bypass
    Krytyczna · 9.9 CVE-2026-44791 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  38. n8n Has an Arbitrary File Read via Git Node
    Krytyczna · 8.8 CVE-2026-44790 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  39. n8n: HTTP Request Node Pagination Prototype Pollution to RCE
    Krytyczna · 9.9 CVE-2026-44789 < 1.123.43, >= 2.21.0, < 2.22.1, >= 2.0.0-rc.0, < 2.20.7 1.123.43, 2.22.1, 2.20.7
  40. n8n has XML Node Prototype Pollution that to RCE
    Krytyczna · 9.9 CVE-2026-42232 >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4, < 1.123.32 2.18.1, 2.17.4, 1.123.32
  41. n8n has Prototype Pollution in XML Webhook Body Parser that Leads to RCE
    Krytyczna · 10.0 CVE-2026-42231 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  42. n8n Vulnerable to XSS via MCP OAuth client
    Wysoka · 8.2 CVE-2026-42235 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  43. n8n's Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay
    Wysoka · 8.5 CVE-2026-42226 >= 2.17.0, < 2.17.5, < 1.123.33 2.17.5, 1.123.33
  44. n8n has a Python Task Runner Sandbox Escape Vulnerability
    Wysoka · 7.5 CVE-2026-42234 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.17.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  45. n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration
    Wysoka · 7.5 CVE-2026-42236 < 1.123.32, >= 2.18.0, < 2.18.1, >= 2.0.0, < 2.17.4 1.123.32, 2.18.1, 2.17.4
  46. n8n has SQL Injection in Data Table Node via orderByColumn Expression
    Wysoka · 9.9 CVE-2026-33713 < 1.123.26, >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3 1.123.26, 2.14.1, 2.13.3
  47. n8n: Prototype Pollution in XML and GSuiteAdmin node parameters lead to RCE
    Krytyczna · 9.9 CVE-2026-33696 >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3, < 1.123.27 2.14.1, 2.13.3, 1.123.27
  48. n8n Has External Secrets Authorization Bypass in Credential Saving
    Wysoka · 6.3 CVE-2026-33722 < 1.123.23, >= 2.0.0-rc.0, < 2.6.4 1.123.23, 2.6.4
  49. n8n: LDAP Email-Based Account Linking Allows Privilege Escalation and Account Takeover
    Wysoka · 8.2 CVE-2026-33665 >= 2.0.0-rc.0, < 2.4.0, < 1.121.0 2.4.0, 1.121.0
  50. n8n is Vulnerable to Credential Theft via Name-Based Resolution and Permission Checker Bypass in Community Edition
    Wysoka · 9.9 CVE-2026-33663 < 1.123.27, >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3 1.123.27, 2.14.1, 2.13.3
  51. n8n has Multiple Remote Code Execution Vulnerabilities in Merge Node AlaSQL SQL Mode
    Krytyczna · 9.9 CVE-2026-33660 >= 2.14.0, < 2.14.1, >= 2.0.0-rc.0, < 2.13.3, < 1.123.27 2.14.1, 2.13.3, 1.123.27
  52. n8n has In-Process Memory Disclosure in its Task Runner
    Wysoka · 6.5 CVE-2026-27496 < 1.123.22, >= 2.10.0, < 2.10.1, >= 2.0.0-rc.0, < 2.9.3 1.123.22, 2.10.1, 2.9.3
  53. n8n Vulnerable to Stored XSS via Various Nodes
    Wysoka · 5.4 CVE-2026-27578 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  54. n8n: Expression Sandbox Escape Leads to RCE
    Krytyczna · 9.9 CVE-2026-27577 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  55. n8n has Arbitrary Command Execution via File Write and Git Operations
    Krytyczna · 8.5 CVE-2026-27498 < 1.123.8, >= 2.0.0, < 2.2.0 1.123.8, 2.2.0
  56. n8n has Potential Remote Code Execution via Merge Node
    Krytyczna · 9.9 CVE-2026-27497 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  57. n8n has a Sandbox Escape in its JavaScript Task Runner
    Krytyczna CVE-2026-27495 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  58. n8n has Arbitrary File Read via Python Code Node Sandbox Escape
    Wysoka · 9.9 CVE-2026-27494 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  59. n8n has Unauthenticated Expression Evaluation via Form Node
    Krytyczna · 9.0 CVE-2026-27493 < 1.123.22, >= 2.0.0, < 2.9.3, >= 2.10.0, < 2.10.1 1.123.22, 2.9.3, 2.10.1
  60. n8n has a Python sandbox escape
    Krytyczna · 9.9 CVE-2026-25115 < 2.4.8 2.4.8
  61. n8n Merge Node has Arbitrary File Write leading to RCE
    Krytyczna CVE-2026-25056 < 1.118.0, >= 2.0.0, < 2.4.0 1.118.0, 2.4.0
  62. n8n Vulnerable to Arbitrary File Write on Remote Systems via SSH Node
    Wysoka CVE-2026-25055 >= 2.0.0, < 2.4.0, < 1.123.12 2.4.0, 1.123.12
  63. n8n Has Stored Cross-site Scripting via Markdown Rendering in Workflow UI
    Wysoka CVE-2026-25054 >= 2.0.0, < 2.2.1, < 1.123.9 2.2.1, 1.123.9
  64. n8n has OS Command Injection in Git Node
    Krytyczna CVE-2026-25053 >= 2.0.0, < 2.5.0, < 1.123.10 2.5.0, 1.123.10
  65. n8n's Improper File Access Controls Allow Arbitrary File Read by Authenticated Users
    Krytyczna CVE-2026-25052 >= 2.0.0, < 2.5.0, < 1.123.18 2.5.0, 1.123.18
  66. n8n's Improper CSP Enforcement in Webhook Responses May Allow Stored XSS
    Wysoka CVE-2026-25051 >= 1.123.0, < 1.123.2, < 1.122.5 1.123.2, 1.122.5
  67. n8n Has Expression Escape Vulnerability Leading to RCE
    Krytyczna CVE-2026-25049 < 1.123.17, >= 2.0.0, < 2.5.2 1.123.17, 2.5.2
  68. n8n Vulnerable to Command Injection in Community Package Installation
    Krytyczna CVE-2026-21893 >= 0.187.0, < 1.120.3 1.120.3
  69. n8n's Unsafe Buffer Allocation Allows In-Process Memory Disclosure in Task Runner
    Wysoka · 7.7 CVE-2025-61917 >= 1.65.0, < 1.114.3 1.114.3
  70. n8n Unsafe Workflow Expression Evaluation Allows Remote Code Execution
    Krytyczna · 9.9 CVE-2026-1470 < 1.123.17, >= 2.0.0, < 2.4.5, >= 2.5.0, < 2.5.1 1.123.17, 2.4.5, 2.5.1
  71. n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
    Krytyczna · 10.0 CVE-2026-21858 >= 1.65.0, < 1.121.0 1.121.0
  72. n8n Vulnerable to RCE via Arbitrary File Write
    Krytyczna · 9.9 CVE-2026-21877 >= 0.123.0, < 1.121.3 1.121.3
  73. Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
    Wysoka · 7.1 CVE-2025-68697 >= 1.2.1, < 2.0.0 2.0.0
  74. n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
    Krytyczna · 9.9 CVE-2025-68668 >= 1.0.0, < 2.0.0 2.0.0
  75. n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
    Wysoka · 7.3 CVE-2025-61914 < 1.114.0 1.114.0
  76. n8n Vulnerable to Remote Code Execution via Expression Injection
    Krytyczna · 9.9 Wykorzystywana w atakach CVE-2025-68613 >= 0.211.0, < 1.120.4, >= 1.121.0, < 1.121.1 1.120.4, 1.121.1
  77. n8n vulnerable to Remote Code Execution via Git Node Custom Pre-Commit Hook
    Krytyczna CVE-2025-65964 >= 0.123.1, < 1.119.2 1.119.2
  78. n8n Vulnerable to Remote Code Execution via Git Node Pre-Commit Hook
    Wysoka · 8.8 CVE-2025-62726 < 1.113.0 1.113.0
  79. n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host
    Wysoka · 8.8 CVE-2025-71380 <= 1.114.4 brak poprawki
  80. Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source
    Wysoka · 8.7 CVE-2025-52478 >= 1.77.0, < 1.98.2 1.98.2
  81. n8n Information Disclosure vulnerability
    Wysoka · 7.5 CVE-2023-27564 < 0.216.1 0.216.1
  82. n8n Privilege Escalation vulnerability
    Wysoka · 8.8 CVE-2023-27563 < 0.216.1 0.216.1

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację
Newsletter DockRay

Bezpieczeństwo aplikacji w Twojej skrzynce

Najważniejsze podatności, konkretne zalecenia i praktyczne wskazówki dla Twoich aplikacji. Wybierz technologie i śledź to, co ma znaczenie dla Twojego projektu.

  • Codzienne zestawienie nowych podatności, także krytycznych.
  • Powiadomienia o ważnych aktualizacjach.
  • Praktyczne porady o bezpieczeństwie i monitoringu aplikacji.

Pozostaw puste, aby otrzymywać informacje o wszystkich technologiach.

Polityka prywatności

Zapis jest bezpłatny. Wypiszesz się jednym kliknięciem w wiadomości.