A Sneaky Credential Bypass in n8n Workflows
A recent discovery has highlighted a security flaw in n8n, a popular workflow automation tool. This vulnerability, tracked as CVE-2026-72774, could allow an authenticated user with specific access to a shared workflow to potentially gain access to another user’s stored credentials. It’s a subtle bypass that warrants attention from anyone using affected versions of n8n.
Imagine having a workflow that needs to interact with various online services, each requiring its own login details. n8n helps manage these credentials securely. However, this vulnerability means that if a malicious actor is an authenticated member with edit access to a shared workflow, they could craft a special request within the HTTP Request node. By using an expression to specify a credential type, they could trick the system into loading and potentially exfiltrating credentials they shouldn’t have access to. The critical point here is that the system’s pre-execution check on permissions looks at the expression, not the actual credential type it resolves to during execution, effectively skipping the necessary ownership verification.
CVE Details
- Product: n8n
- Published: August 11, 2026
- Severity: Medium
- Status: Analyzed
Affected Products
The credential authorization bypass affects several versions of n8n. Specifically, any installations running the following versions are vulnerable:
- n8n versions prior to 1.123.67
- n8n versions prior to 2.31.5
- n8n version 2.32.0 (specifically, versions before 2.32.1)
Users are strongly advised to check their n8n instance version to determine if they are at risk.
Current Status
As of its publication date, this vulnerability has been “Analyzed.” This status indicates that the details of the flaw are understood, and its impact has been assessed. While the analysis is complete, proactive steps are still required by users to secure their systems.
Severity Level
This vulnerability is rated as Medium severity. A medium rating means that while the flaw is serious, exploiting it typically requires certain conditions or user interaction. In this case, an attacker must already be an authenticated member of the n8n instance and have edit access to a shared workflow. They also need to know the specific identifier of the target credential they wish to access. These prerequisites reduce the overall ease of exploitation but do not eliminate the risk, especially in environments where workflow sharing is common or internal threat actors are a concern.
Possible Solutions
To protect your n8n instances from this credential authorization bypass, the most effective solution is to upgrade to a patched version immediately. The developers have released updates addressing this issue. Users should upgrade to:
- n8n version 1.123.67 or a later release in the 1.x branch.
- n8n version 2.31.5 or a later release in the 2.x branch.
- n8n version 2.32.1 or a later release in the 2.x branch.
Upgrading ensures that the permission checks are correctly applied, preventing unauthorized access to sensitive credentials within your workflows. Always test updates in a staging environment before deploying to production.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-6qc9-mqvw-jg7x
https://www.vulncheck.com/advisories/n8n-before-authentication-bypass-via-http-request-node
