CVE-2026-77081

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node.

N8N

n8n before 1.123.69, 2.x before 2.33.4, and 2.x before 2.34.1 contain an allowed-domains bypass in the GraphQL node. When the node's Authentication parameter is set to expression mode, every authentication-gated credential selector is treated as active; if two credentials of different types are attached, the node enforces the allowed-domains policy of only the first credential while still attaching material from both. An authenticated user with workflow-authoring rights can…

20. Aug 2026

Ausgewertete Quellen

• Hinweis
  https://www.vulncheck.com/advisories/n8n-before-allowed-domains-bypass-via-graphql-node
• NVD
  CVE-2026-77081
• GitHub
  https://github.com/n8n-io/n8n/security/advisories/GHSA-wcv8-x773-j96r