Alex Joseph
Understanding the n8n Credential Vulnerability
A significant security flaw, identified as CVE-2026-65596, has been discovered in n8n, a popular workflow automation platform. This vulnerability allows an authenticated user to potentially steal sensitive information, specifically HTTP-based credentials, due to improper enforcement of domain restrictions within the GraphQL node. This issue is particularly concerning for organizations that utilize n8n to automate tasks involving external services.
In simpler terms, if your n8n setup uses the GraphQL node and has credentials (like API keys or authentication tokens) configured with “Allowed HTTP Request Domains” — and these credentials are also accessible to users who don’t own them — then those credentials could be at risk. An attacker with workflow creation or editing privileges could craft a malicious workflow to send these restricted credentials to a server they control, effectively stealing them.
CVE Details
- Product: n8n
- Published Date: July 22, 2026
- Severity: HIGH
- CVSS Score: 8.1
- Status: Analyzed
Affected Products
The vulnerability impacts various versions of n8n, including both Community and Enterprise editions:
- n8n Community Edition versions prior to 1.123.64, 2.29.8, and 2.30.1
- n8n Enterprise Edition versions prior to 1.123.64, 2.29.8, and 2.30.1
Specifically, versions such as n8n:2.30.0 (both community and enterprise) are known to be affected.
Current Status
This vulnerability has been thoroughly analyzed, and the good news is that patches are available. n8n has released updated versions that address this critical flaw, and users are strongly encouraged to upgrade as soon as possible.
Severity Level
Rated with a CVSS score of 8.1, this is considered a HIGH severity vulnerability. This classification indicates that a successful exploit could lead to significant unauthorized access to confidential information. Credential exfiltration can have severe consequences, including unauthorized access to other systems, data breaches, and potential financial losses.
Possible Solutions
To protect your n8n instances and prevent credential exfiltration, follow these recommended steps:
Apply Patches Immediately
The most effective solution is to upgrade your n8n installation to a patched version. The issue has been fixed in:
- n8n version 1.123.64 and later
- n8n version 2.29.8 and later
- n8n version 2.30.1 and later
Ensure you update to one of these versions or a newer release to fully resolve the vulnerability.
Temporary Mitigations (If Immediate Upgrade is Not Possible)
If you cannot apply the patch right away, consider these temporary workarounds. Please note these do not fully eliminate the risk but can help reduce exposure:
- Restrict Workflow Permissions: Limit the ability to create and edit workflows strictly to fully trusted users.
- Control Credential Sharing: Restrict the sharing of credentials to only trusted users.
- Audit Existing Credentials: Regularly review credentials that have “Allowed HTTP Request Domains” configured for any unexpected or overly permissive sharing arrangements.
These mitigations should only serve as short-term measures while you plan and execute your upgrade to a patched version.
References
https://github.com/n8n-io/n8n/security/advisories/GHSA-gq66-9cw5-j5jm
https://www.vulncheck.com/advisories/n8n-before-credential-exfiltration-via-graphql-node
