high

CVE-2026-59207

npm · n8n

Summary

n8n: "Allowed HTTP Request Domains" Restriction Bypass via AI Agents MCP Connector

Severity
high
EPSS
0.4% (p39)
CWE
CWE-693
Also known as
GHSA-h44j-f5r5-ph73
Published
2026-07-22
Updated
2026-07-22

Advisory details

Impact

The AI Agents feature did not enforce the "Allowed HTTP Request Domains" restriction configured on credentials. As a result, a member-level user who had been granted use-only access to a shared credential could cause its secret to be sent to an external server they control, by pointing an MCP tool at an arbitrary URL and running the agent.

This issue only affects instances where the AI Agents module is enabled via N8N_ENABLED_MODULES=agents and at least one credential with domain restrictions has been shared with a member-level user.

Patches

The issue has been fixed in n8n version 2.28.1 and 2.27.4. Users should upgrade to this version or later to remediate the vulnerability.

Workarounds

If upgrading is not immediately possible, administrators should consider the following temporary mitigations:

These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

References

Related advisories

Is your project exposed to this? Stateward checks every dependency on every pull request and flags it only if your code actually reaches it.

Check my repo

Summarize with AI

ChatGPTClaudePerplexity

Sources: CISA KEV (public domain), OSV.dev & GitHub Advisory Database (CC-BY-4.0), FIRST EPSS, NVD/CWE (public domain). Served live from the Stateward advisory database.