{"id":"CVE-2026-72771","aliases":["GHSA-64xh-79j6-r5v8"],"url":"https://o3.security/vulnerability/CVE-2026-72771","summary":"n8n before 2.32.1 Credential Restriction Bypass via AI/LLM Nodes","details":"## Impact\n\nThe credential \"Allowed HTTP Request Domains\" allowlist was intended to restrict which hosts a credential's secret could be sent to, protecting shared credentials from users who could use but not view them. Several AI/LLM nodes did not enforce this allowlist when a user-supplied base or endpoint URL was set. A low-privileged workflow editor with use-only access to such a shared credential could point one of these nodes at an attacker-controlled host and cause the credential secret to be transmitted there, then reuse it against the underlying service.\n\nOnly instances where a credential has \"Allowed HTTP Request Domains\" configured and is shared with non-owner users are affected.\n\n## Patches\nThe issue has been fixed in n8n versions 2.31.5 and 2.32.1. Users should upgrade to one of these versions or later to remediate the vulnerability.\n\n## Workarounds\nIf upgrading is not immediately possible, administrators should consider the following temporary mitigations:\n- Restrict workflow creation and editing permissions to fully trusted users only.\n- Restrict credential sharing to fully trusted users only.\n- Audit credentials with domain restrictions for unexpected sharing relationships.\n\nThese workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.","published":"2026-08-11T12:17:10.581Z","modified":"2026-10-21T02:30:22.668461108Z","cvss":null,"epss":{"score":0.00209,"percentile":0.11253,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"n8n","fixedVersion":"2.32.1"},{"ecosystem":"npm","name":"n8n","fixedVersion":"2.31.5"}],"fix":{"url":"https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f","label":"n8n-io/n8n@f69dfc6"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72771.json"},{"type":"ADVISORY","url":"https://github.com/n8n-io/n8n/security/advisories/GHSA-64xh-79j6-r5v8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72771"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/n8n-before-credential-restriction-bypass-via-ai-llm-nodes"},{"type":"WEB","url":"https://github.com/n8n-io/n8n/commit/f69dfc6dd2178a14ea1624d2e1d403c2e755042f"},{"type":"PACKAGE","url":"https://github.com/n8n-io/n8n"},{"type":"WEB","url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.31.5"},{"type":"WEB","url":"https://github.com/n8n-io/n8n/releases/tag/n8n@2.32.1"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-21T02:30:22.668461108Z"}}